gchq/CyberChef · error · OperationError

${err}

Error message

${err}

What it means

Thrown by the Fernet Encrypt operation when the underlying fernet library raises an exception during secret creation or token.encode(). The error wraps the library's own error. Fernet encryption requires a valid 32-byte base64-encoded secret key to initialize AES-128-CBC with HMAC-SHA256.

Source

Thrown at src/core/operations/FernetEncrypt.mjs:49

                "value": ""
            },
        ];
    }
    /**
     * @param {String} input
     * @param {Object[]} args
     * @returns {String}
     */
    run(input, args) {
        const [secretInput] = args;
        try {
            const secret = new fernet.Secret(secretInput);
            const token = new fernet.Token({
                secret: secret,
            });
            return token.encode(input);
        } catch (err) {
            throw new OperationError(err);
        }
    }
}

export default FernetEncrypt;

View on GitHub (pinned to 4290ea7539)

Solutions

1. Provide a valid 32-byte (256-bit) secret key encoded as base64 (standard or urlsafe).
2. Generate a key with: python -c "from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())".
3. Verify the key decodes to exactly 32 bytes.
4. Check the wrapped error for the specific library message.

Example fix

// before: key = 'tooshort' -> fernet.Secret throws

// after: key = 'ZmDfcTF7_60GrrY167zsiPd67pEvs0aGOv2oasOM1Pg='
//         (43-char base64url, decodes to 32 bytes)

// Validate Fernet key is 32 bytes base64 before encrypting
const keyBytes = Buffer.from(secretInput, 'base64');
if (keyBytes.length !== 32) {
  throw new Error('Fernet key must decode to exactly 32 bytes');
}

function isValidFernetKey(keyStr) {
  try {
    const decoded = Buffer.from(keyStr, 'base64');
    return decoded.length === 32;
  } catch { return false; }
}

try {
  const token = chef.fernetEncrypt(input, [key]);
} catch (e) {
  if (e.message.includes('key')) {
    // Invalid key format
  } else throw e;
}

When it happens

Trigger: run(input, args) inside the try block (line 42) where new fernet.Secret(secretInput) fails (key not 32 bytes / invalid base64) or token.encode(input) fails.

Common situations: Key is not 32 bytes when base64-decoded, key contains invalid base64 characters, or the key string is empty/malformed. The input plaintext itself rarely causes errors.

Related errors

• ${err}
• Please enter a private key.
• Provided key is not an EC key.
• Provided key is not a private key.
• Please enter a public key.

AI-assisted analysis of gchq/CyberChef@4290ea7539 (2026-08-13). Data as JSON: /api/errors/95fa32775d75f6fc. Report an issue: GitHub.