gchq/CyberChef · error · OperationError

${err}

Error message

${err}

What it means

Thrown by the Fernet Decrypt operation when the underlying fernet library raises an exception during secret creation, token construction, or token.decode(). The error is wrapped and re-thrown. Fernet is symmetric encryption using AES-128-CBC with HMAC-SHA256; decryption requires a valid 32-byte base64-encoded key and a well-formed Fernet token.

Source

Thrown at src/core/operations/FernetDecrypt.mjs:58

        ];
    }
    /**
     * @param {String} input
     * @param {Object[]} args
     * @returns {String}
     */
    run(input, args) {
        const [secretInput] = args;
        try {
            const secret = new fernet.Secret(secretInput);
            const token = new fernet.Token({
                secret: secret,
                token: input,
                ttl: 0
            });
            return token.decode();
        } catch (err) {
            throw new OperationError(err);
        }
    }
}

export default FernetDecrypt;

View on GitHub (pinned to 4290ea7539)

Solutions

1. Verify the key is a valid 32-byte (256-bit) value base64url-encoded string.
2. Confirm the input is a well-formed Fernet token generated by the corresponding Fernet Encrypt operation.
3. Check the wrapped error message for specifics (e.g., 'Invalid key', 'HMAC verification failed').
4. Ensure the key matches the one used for encryption.

Example fix

// before: key = 'shortkey', token = 'gAAAAA...' -> fernet throws

// after: key = 'YWJjZGVmZ2hpamtsbW5vcHFyc3R1dnd4eXoxMjM0NTY=' (32-byte b64)
//         token = valid Fernet token from same key

// Validate Fernet key is 32 bytes base64 before decrypting
const keyBytes = Buffer.from(secretInput, 'base64');
if (keyBytes.length !== 32) {
  throw new Error('Fernet key must decode to exactly 32 bytes');
}

function isValidFernetKey(keyStr) {
  try {
    const decoded = Buffer.from(keyStr, 'base64');
    return decoded.length === 32;
  } catch { return false; }
}

try {
  const plaintext = chef.fernetDecrypt(input, [key]);
} catch (e) {
  if (e.message.includes('HMAC') || e.message.includes('key')) {
    // Wrong key or tampered token
  } else throw e;
}

When it happens

Trigger: run(input, args) inside the try block (line 49) where new fernet.Secret(secretInput) fails (invalid key), new fernet.Token({...}) fails (malformed token), or token.decode() fails (HMAC mismatch, invalid ciphertext, wrong key).

Common situations: Wrong decryption key, key not 32 bytes in base64, malformed/truncated Fernet token, or token encrypted with a different key. Also when the input string is not a valid Fernet token format.

Related errors

• ${err}
• Invalid PKCS#5 padding.
• Invalid BIT padding.
• Please enter a private key.
• Provided key is not an EC key.

AI-assisted analysis of gchq/CyberChef@4290ea7539 (2026-08-13). Data as JSON: /api/errors/adf5bad24094584d. Report an issue: GitHub.