gchq/CyberChef · error · OperationError

Input is not a JSON Web Key

Error message

Input is not a JSON Web Key

What it means

Thrown by JWK to PEM when the parsed input is not shaped like any recognised JSON Web Key container. The operation accepts three shapes: an array of keys, a JSON Web Key Set ({ keys: [...] }), or a single key object. If the parsed value is none of these (a primitive scalar), this fires.

Source

Thrown at src/core/operations/JWKToPem.mjs:57

     * @param {string} input
     * @param {Object[]} args
     * @returns {string}
     */
    run(input, args) {
        const inputJson = JSON.parse(input);

        let keys = [];
        if (Array.isArray(inputJson)) {
            // list of keys => transform all keys
            keys = inputJson;
        } else if (Array.isArray(inputJson.keys)) {
            // JSON Web Key Set => transform all keys
            keys = inputJson.keys;
        } else if (typeof inputJson === "object") {
            // single key
            keys.push(inputJson);
        } else {
            throw new OperationError("Input is not a JSON Web Key");
        }

        let output = "";
        for (let i=0; i<keys.length; i++) {
            const jwk = keys[i];
            if (typeof jwk.kty !== "string") {
                throw new OperationError("Invalid JWK format");
            } else if ("|RSA|EC|".indexOf(jwk.kty) === -1) {
                throw new OperationError(`Unsupported JWK key type '${inputJson.kty}'`);
            }

            const key = r.KEYUTIL.getKey(jwk);
            const pem = key.isPrivate ? r.KEYUTIL.getPEM(key, "PKCS8PRV") : r.KEYUTIL.getPEM(key);

            // PEM ends with '\n', so a new key always starts on a new line
            output += pem;
        }

View on GitHub (pinned to 4290ea7539)

Solutions

1. Provide a JWK object with a 'kty' field, a JWKS { keys: [...] }, or an array of JWKs.
2. If the input is PEM, use the PEM-to-JWT/key path instead of JWK to PEM.
3. Validate that the parsed value is a non-null object or array before converting.

Example fix

// before: primitive input
chef.JWKToPem('not-a-key');
// after: a valid single JWK
chef.JWKToPem(JSON.stringify({ kty: 'RSA', n: '...', e: 'AQAB' }));

function ensureJwkContainer(parsed) {
  if (Array.isArray(parsed) || (parsed && typeof parsed === 'object' && Array.isArray(parsed.keys)) ||
      (parsed && typeof parsed === 'object' && typeof parsed.kty === 'string')) return parsed;
  throw new Error('Input must be a JWK, a JWKS {keys:[...]}, or an array of JWKs');
}

function isJwkContainer(p) {
  if (Array.isArray(p)) return p.every(k => k && typeof k === 'object');
  if (p && typeof p === 'object') return Array.isArray(p.keys) || typeof p.kty === 'string';
  return false;
}

try {
  return chef.JWKToPem(input);
} catch (e) {
  if (/not a JSON Web Key/.test(e.message)) throw new Error('Supply a JWK/JWKS object, not a scalar');
  throw e;
}

When it happens

Trigger: The JSON parses to a primitive: the string "hello", a number like 123, a boolean, or null. Also any non-array, non-'keys'-bearing value whose typeof is not 'object'.

Common situations: Feeding a raw base64 key blob instead of a JWK. Passing a PEM string by mistake. Input that decodes to a single scalar rather than a key structure.

Related errors

• Invalid JWK format
• Unsupported JWK key type '${inputJson.kty}'
• ${err.toString()}
• Error: ${err.toString()}
• Invalid Base64 payload

AI-assisted analysis of gchq/CyberChef@4290ea7539 (2026-08-13). Data as JSON: /api/errors/57970da1ec520a98. Report an issue: GitHub.