gchq/CyberChef · error · OperationError

Invalid Bech32 string: data part is too short (minimum 6 cha

Error message

Invalid Bech32 string: data part is too short (minimum 6 characters for checksum).

What it means

Thrown by decode() in src/core/lib/Bech32.mjs:268 when, after the separator, fewer than 6 characters remain (sepIndex + 7 > str.length). Bech32/Bech32m always appends exactly 6 checksum characters after the data, so the data part (data + checksum) must be at least 6 characters long; anything shorter cannot carry a valid checksum.

Source

Thrown at src/core/lib/Bech32.mjs:268

    if (hasUpper && hasLower) {
        throw new OperationError("Invalid Bech32 string: mixed case is not allowed. Use all uppercase or all lowercase.");
    }

    // Convert to lowercase for processing
    str = str.toLowerCase();

    // Find separator (last occurrence of '1')
    const sepIndex = str.lastIndexOf("1");
    if (sepIndex === -1) {
        throw new OperationError("Invalid Bech32 string: no separator '1' found.");
    }

    if (sepIndex === 0) {
        throw new OperationError("Invalid Bech32 string: Human-Readable Part (HRP) cannot be empty.");
    }

    if (sepIndex + 7 > str.length) {
        throw new OperationError("Invalid Bech32 string: data part is too short (minimum 6 characters for checksum).");
    }

    // Extract HRP and data part
    const hrp = str.substring(0, sepIndex);
    const dataPart = str.substring(sepIndex + 1);

    // Validate HRP characters
    for (let i = 0; i < hrp.length; i++) {
        const c = hrp.charCodeAt(i);
        if (c < 33 || c > 126) {
            throw new OperationError(`HRP contains invalid character at position ${i}.`);
        }
    }

    // Decode data characters to 5-bit values
    const data = [];
    for (let i = 0; i < dataPart.length; i++) {
        const c = dataPart[i];

View on GitHub (pinned to 4290ea7539)

Solutions

1. Verify the address is complete — the part after '1' must be at least 6 characters (checksum) plus any data words.
2. Re-copy the full address from its source.
3. Add a length pre-check: if (str.lastIndexOf('1') + 7 > str.length) warn the user.
4. For SegWit addresses, expect at least HRP + '1' + version + program words + 6 checksum chars.

Example fix

// before - checksum truncated
decode('bc1q'); // too short after separator

// after - full address with checksum
decode('bc1qar0srrr7xfkvy5l643lydnw9re59gtzzwf5mdq'); // 39 chars after '1'

function hasEnoughDataAfterSeparator(str) {
  const sep = str.lastIndexOf('1');
  return sep !== -1 && sep + 7 <= str.length;
}

function isLongEnoughBech32(s) {
  if (typeof s !== 'string') return false;
  const i = s.lastIndexOf('1');
  return i !== -1 && i + 7 <= s.length;
}

try {
  decode(input);
} catch (e) {
  if (e instanceof OperationError && /data part is too short/.test(e.message)) {
    // address is truncated; ask the user to re-copy
  }
}

When it happens

Trigger: decode('bc1') (sepIndex=2, str.length=3, 2+7=9 > 3), decode('bc1ab') (only 2 chars after separator, < 6). Any input where the substring after the last '1' is shorter than 6 characters.

Common situations: Truncated address missing the checksum; a string that ends right at or just after the separator; user typed only the HRP and separator; copy-paste that cut off the tail.

Related errors

• Invalid Bech32 string: exceeds maximum length of 90 characte
• Invalid padding: too many bits remaining
• Encoded string exceeds maximum length of 90 characters (got
• Input cannot be empty.
• Invalid Bech32 string: mixed case is not allowed. Use all up

AI-assisted analysis of gchq/CyberChef@4290ea7539 (2026-08-13). Data as JSON: /api/errors/94c879591fb543cf. Report an issue: GitHub.