gchq/CyberChef · error · OperationError

Invalid key length: ${key.length} bytes Blowfish's key leng

Error message

Invalid key length: ${key.length} bytes

Blowfish's key length needs to be between 4 and 56 bytes (32-448 bits).

What it means

Blowfish accepts a variable-length key between 4 and 56 bytes (32-448 bits). The operation converts args[0] to a byte string and throws this when its length is outside that range, since Blowfish's key schedule rejects keys shorter than 4 bytes or longer than 56 bytes.

Source

Thrown at src/core/operations/BlowfishDecrypt.mjs:74

                "value": ["Raw", "Hex"]
            }
        ];
    }

    /**
     * @param {string} input
     * @param {Object[]} args
     * @returns {string}
     */
    run(input, args) {
        const key = Utils.convertToByteString(args[0].string, args[0].option),
            iv = Utils.convertToByteString(args[1].string, args[1].option),
            mode = args[2],
            inputType = args[3],
            outputType = args[4];

        if (key.length < 4 || key.length > 56) {
            throw new OperationError(`Invalid key length: ${key.length} bytes

Blowfish's key length needs to be between 4 and 56 bytes (32-448 bits).`);
        }

        if (mode !== "ECB" && iv.length !== 8) {
            throw new OperationError(`Invalid IV length: ${iv.length} bytes. Expected 8 bytes.`);
        }

        input = Utils.convertToByteString(input, inputType);

        const decipher = Blowfish.createDecipher(key, mode);
        decipher.start({iv: iv});
        decipher.update(forge.util.createBuffer(input));
        const result = decipher.finish();

        if (result) {
            return outputType === "Hex" ? decipher.output.toHex() : decipher.output.getBytes();
        } else {

View on GitHub (pinned to 4290ea7539)

Solutions

1. Verify the key byte length is between 4 and 56 inclusive after applying the chosen input option.
2. Double-check the args[0].option (Hex/Base64/UTF8) matches how your key material is encoded.
3. Trim whitespace/newlines from user-supplied key strings before conversion.

Example fix

// before
key option 'UTF8' with 'abc' (3 bytes)
// after
key option 'UTF8' with 'abcd' (4 bytes)

const keyBytes = Utils.convertToByteString(args[0].string, args[0].option);
if (keyBytes.length < 4 || keyBytes.length > 56) {
  throw new Error(`Blowfish key length ${keyBytes.length} out of range`);
}

function isValidBlowfishKey(len) { return len >= 4 && len <= 56; }

When it happens

Trigger: Calling BlowfishDecrypt.run with a key (args[0].string interpreted via args[0].option) whose byte length is < 4 or > 56.

Common situations: Using a too-short password as a key; specifying the wrong key encoding option (e.g. treating hex text as UTF-8 doubles the byte length); pasting a key with trailing whitespace/newline that changes length.

Related errors

• Invalid key length: ${key.length} bytes Blowfish's key leng
• Invalid IV length: ${iv.length} bytes. Expected 8 bytes.
• Invalid IV length: ${iv.length} bytes. Expected 8 bytes.
• The key for AES must be either 16, 24, or 32 bytes (currentl
• The key for Triple DES must be 16 or 24 bytes (currently ${k

AI-assisted analysis of gchq/CyberChef@4290ea7539 (2026-08-13). Data as JSON: /api/errors/ec83a7a1d978f260. Report an issue: GitHub.