gchq/CyberChef · error · OperationError

Invalid key length: ${key.length} bytes DES uses a key leng

Error message

Invalid key length: ${key.length} bytes

DES uses a key length of 8 bytes (64 bits).

What it means

Thrown by DES Decrypt run() when the supplied key, after conversion to a byte string via Utils.convertToByteString, is not exactly 8 bytes. DES mandates a fixed 64-bit (8-byte) key; node-forge's createDecipher rejects mismatched key material, and this check preempts that with a clear message. The length printed reflects the post-conversion byte count, not the raw user input length.

Source

Thrown at src/core/operations/DESDecrypt.mjs:73

                "value": ["Raw", "Hex"]
            }
        ];
    }

    /**
     * @param {string} input
     * @param {Object[]} args
     * @returns {string}
     */
    run(input, args) {
        const key = Utils.convertToByteString(args[0].string, args[0].option),
            iv = Utils.convertToByteArray(args[1].string, args[1].option),
            mode = args[2].substring(0, 3),
            noPadding = args[2].endsWith("NoPadding"),
            [,,, inputType, outputType] = args;

        if (key.length !== 8) {
            throw new OperationError(`Invalid key length: ${key.length} bytes

DES uses a key length of 8 bytes (64 bits).`);
        }
        if (iv.length !== 8 && mode !== "ECB") {
            throw new OperationError(`Invalid IV length: ${iv.length} bytes

DES uses an IV length of 8 bytes (64 bits).
Make sure you have specified the type correctly (e.g. Hex vs UTF8).`);
        }

        input = Utils.convertToByteString(input, inputType);

        const decipher = forge.cipher.createDecipher("DES-" + mode, key);

        /* Allow for a "no padding" mode */
        if (noPadding) {
            decipher.mode.unpad = function(output, options) {
                return true;

View on GitHub (pinned to 4290ea7539)

Solutions

Provide exactly 8 bytes: either 16 hex digits (Hex), 8 ASCII characters (UTF8/Latin1), or 11 Base64 chars padding to 8 bytes.
Re-check the Key toggle matches how the key is encoded (Hex vs UTF8 vs Base64).
If you intended a longer key, switch to Triple DES or AES instead of single DES.
Verify the byte length: run the key through a From Hex / From Base64 op and check it yields 8 bytes.

Example fix

// before - 6-byte UTF8 key
Key: secret   (toggle: UTF8)

// after - 8-byte key as hex
Key: 7365637265742121   (toggle: Hex)  // decodes to 8 bytes 'secret!!'

Defensive patterns

Strategy: validation

Validate before calling

function desKeyBytes(keyStr, option) {
    const key = Utils.convertToByteString(keyStr, option);
    return key.length === 8 ? key : null;
}
// if null, surface a UI error before calling desDecrypt.run()

Type guard

/** @returns {boolean} */
function isValidDesKey(keyStr, option) {
    try {
        return Utils.convertToByteString(keyStr, option).length === 8;
    } catch {
        return false;
    }
}

Try / catch

try {
    out = desDecrypt.run(input, args);
} catch (e) {
    if (e instanceof OperationError && e.message.startsWith("Invalid key length")) {
        // prompt user to fix the key/encoding
    } else throw e;
}

Prevention

Always provide a DES key as exactly 8 bytes in the encoding matching the toggle.
Distinguish hex (2 chars/byte) from UTF8 (1 char/byte) when entering the key.
For passphrases, hash first instead of using the raw text as a DES key.
Validate byte length with a From Hex/From Base64 op before DES.

When it happens

Trigger: Setting the Key argument with a value whose decoded byte length != 8. For example, 16 hex characters decode to 8 bytes (valid), but 'key123' in UTF8 is 6 bytes, or '00112233445566' is 7 hex bytes, or 'AABBCCDDEEFF00112233' is 10 hex bytes. Any Key toggle (Hex/UTF8/Latin1/Base64) whose decoded result is not 8 bytes triggers it.

Common situations: Confusing hex digits vs raw bytes (typing 8 ASCII characters thinking they are 8 bytes when Hex is selected, yielding 4 bytes); pasting a DES key with parity stripped; using an AES/3DES key by mistake; leaving the Key field with a default placeholder string.

Related errors

AI-assisted analysis of gchq/CyberChef@4290ea7539 (2026-08-13). Data as JSON: /api/errors/b1d2ff5b20f8c271. Report an issue: GitHub.