{"record":{"id":"f3d949966f8cbb76","repo":"cloudflare/cloudflared","slug":"decoded-tunnel-secret-must-be-at-least-32-bytes-lo","errorCode":null,"errorMessage":"Decoded tunnel secret must be at least 32 bytes long","messagePattern":"Decoded tunnel secret must be at least 32 bytes long","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/cloudflared/tunnel/subcommand_context.go","lineNumber":145,"sourceCode":"\tclient, err := sc.client()\n\tif err != nil {\n\t\treturn nil, errors.Wrap(err, \"couldn't create client to talk to Cloudflare Tunnel backend\")\n\t}\n\n\tvar tunnelSecret []byte\n\tif secret == \"\" {\n\t\ttunnelSecret, err = generateTunnelSecret()\n\t\tif err != nil {\n\t\t\treturn nil, errors.Wrap(err, \"couldn't generate the secret for your new tunnel\")\n\t\t}\n\t} else {\n\t\tdecodedSecret, err := base64.StdEncoding.DecodeString(secret)\n\t\tif err != nil {\n\t\t\treturn nil, errors.Wrap(err, \"Couldn't decode tunnel secret from base64\")\n\t\t}\n\t\ttunnelSecret = decodedSecret\n\t\tif len(tunnelSecret) < 32 {\n\t\t\treturn nil, errors.New(\"Decoded tunnel secret must be at least 32 bytes long\")\n\t\t}\n\t}\n\n\ttunnel, err := client.CreateTunnel(name, tunnelSecret)\n\tif err != nil {\n\t\treturn nil, errors.Wrap(err, \"Create Tunnel API call failed\")\n\t}\n\n\tcredential, err := sc.credential()\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\ttunnelCredentials := connection.Credentials{\n\t\tAccountTag:   credential.AccountID(),\n\t\tTunnelSecret: tunnelSecret,\n\t\tTunnelID:     tunnel.ID,\n\t\tEndpoint:     credential.Endpoint(),","sourceCodeStart":127,"sourceCodeEnd":163,"githubUrl":"https://github.com/cloudflare/cloudflared/blob/2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f/cmd/cloudflared/tunnel/subcommand_context.go#L127-L163","documentation":"When creating a Named Tunnel with a user-supplied secret (--tunnel-secret), create() base64-decodes it and enforces a minimum length of 32 bytes. A shorter decoded secret cannot be used as tunnel credentials, so creation is aborted.","triggerScenarios":"Running `cloudflared tunnel create <name> --secret <base64>` where the decoded secret is under 32 bytes; using runAdhocNamedTunnel with a short secret.","commonSituations":"Hand-crafting secrets with short random strings; encoding a 16-byte value instead of 32; truncating generated secrets before base64 encoding.","solutions":["Generate a secret of at least 32 bytes before encoding, e.g. `head -c 32 /dev/urandom | base64`.","Verify decoded length: `echo '<secret>' | base64 -d | wc -c` must be >= 32.","Omit --secret and let cloudflared generate a compliant random secret automatically."],"exampleFix":"// before\nSECRET=$(echo -n \"shortsecret\" | base64)   # 10 bytes decoded\ncloudflared tunnel create mytunnel --secret \"$SECRET\"\n// after\nSECRET=$(head -c 32 /dev/urandom | base64)  # 32 bytes decoded\ncloudflared tunnel create mytunnel --secret \"$SECRET\"","handlingStrategy":"validation","validationCode":"decoded, err := base64.StdEncoding.DecodeString(secret)\nif err != nil {\n    return fmt.Errorf(\"secret is not valid base64: %w\", err)\n}\nif len(decoded) < 32 {\n    return fmt.Errorf(\"secret decodes to %d bytes; need >= 32\", len(decoded))\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Generate secrets with `head -c 32 /dev/urandom | base64`.","Verify decoded byte length before passing --secret.","Let cloudflared auto-generate the secret when no custom one is required."],"tags":["tunnel","secret","validation","crypto"],"backgroundTag":"invalid-argument-value","analyzedSha":"2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f","analyzedAt":"2026-09-06T04:14:33.757Z","contentChangedAt":"2026-09-06T04:14:33.757Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}