gchq/CyberChef · error · OperationError

${err}

Error message

${err}

What it means

Thrown by JWT Decode when the underlying jsonwebtoken decode() throws. The raw Error object is passed straight into OperationError (message `${err}`), which stringifies it. Decode is unauthenticated parsing, so failures here mean the token's structure itself is unreadable.

Source

Thrown at src/core/operations/JWTDecode.mjs:52

            },
        ];
    }

    /**
     * @param {string} input
     * @param {Object[]} args
     * @returns {JSON}
     */
    run(input, args) {
        try {
            const decoded = jwt.decode(input, {
                json: true,
                complete: true
            });

            return decoded.payload;
        } catch (err) {
            throw new OperationError(err);
        }
    }

}

export default JWTDecode;

View on GitHub (pinned to 4290ea7539)

Solutions

1. Confirm the input is a compact JWS with exactly two dots and three base64url segments.
2. Trim whitespace/newlines from the token before decoding.
3. If it is a JWE or another format, use the matching operation, not JWT Decode.
4. Decode each segment manually with base64url to find which part is malformed.

Example fix

// before: not a JWT
chef.JWTDecode('abc.def');
// after: a well-formed compact JWT
chef.JWTDecode('header.payload.signature');

function looksLikeJwt(s) {
  if (typeof s !== 'string') return false;
  const parts = s.trim().split('.');
  return parts.length === 3 && parts.every(p => /^[A-Za-z0-9_-]*$/.test(p));
}

function isCompactJwt(s) {
  return typeof s === 'string' && s.trim().split('.').length === 3;
}

try {
  return chef.JWTDecode(input);
} catch (e) {
  throw new Error('Input is not a 3-segment compact JWT');
}

When it happens

Trigger: A string that is not a JWT: wrong number of segments (not three dot-separated parts), header or payload that is not valid base64url, or a payload that does not decode to JSON. Completely non-token input like 'hello'.

Common situations: Pasting a truncated token. Passing a JWE or a SAML assertion instead of a JWT. Tokens with URL-unsafe characters or whitespace/newlines that break segment splitting.

Related errors

• ${err.toString()}
• Error: ${err.toString()}
• Invalid Base64 payload
• ${err}
• ${err}

AI-assisted analysis of gchq/CyberChef@4290ea7539 (2026-08-13). Data as JSON: /api/errors/1a5f2a910ceab64e. Report an issue: GitHub.