What causes "The key must be exactly 32 bytes long" in gchq/CyberChef?

Provide exactly 32 bytes of key material (64 hex chars), or leave the key empty for unkeyed hashing.

gchq/CyberChef · error · OperationError

The key must be exactly 32 bytes long

Error message

The key must be exactly 32 bytes long

What it means

Thrown by BLAKE3.run when a non-empty key is supplied whose decoded length is not exactly 32 bytes. Unlike BLAKE2b/2s which accept a range of key sizes up to a maximum, BLAKE3's keyed mode requires a fixed 32-byte (256-bit) key; any other non-empty length is rejected. An empty key string is allowed and triggers unkeyed hashing.

Source

Thrown at src/core/operations/BLAKE3.mjs:59

                "value": ""
            }
        ];
    }

    /**
     * @param {string} input
     * @param {Object[]} args
     * @returns {string}
     */
    run(input, args) {
        const key = args[1];
        const size = args[0];
        const opts = { dkLen: size };
        const inputBytes = new Uint8Array(Utils.strToArrayBuffer(input));
        if (key !== "") {
            const keyBytes = new Uint8Array(Utils.strToArrayBuffer(key));
            if (keyBytes.length !== 32) {
                throw new OperationError("The key must be exactly 32 bytes long");
            }
            opts.key = keyBytes;
        }
        return bytesToHex(blake3(inputBytes, opts));
    }

}

export default BLAKE3;

View on GitHub (pinned to 4290ea7539)

Solutions

Provide exactly 32 bytes of key material (64 hex chars), or leave the key empty for unkeyed hashing.
Derive a 32-byte key from a passphrase using a KDF before BLAKE3.
Confirm the key input option matches the encoding.

Example fix

// before - 16-byte key
chef.blake3(input, { key: "00112233445566778899aabbccddeeff", keyOption: "Hex" });

// after - exactly 32 bytes
chef.blake3(input, { key: "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", keyOption: "Hex" });

Defensive patterns

Strategy: validation

Validate before calling

function assertBlake3Key(keyStr, keyOption) {
  if (keyStr === "" || keyStr == null) return null;
  const bytes = Utils.convertToByteArray(keyStr, keyOption);
  if (bytes.length !== 32) throw new Error(`BLAKE3 key must be exactly 32 bytes, got ${bytes.length}`);
  return bytes;
}
assertBlake3Key(key, keyOption);

Type guard

function isExactly32ByteHex(s) { return /^[0-9a-f]{64}$/i.test(s); }

Prevention

Use exactly 32 bytes (64 hex chars), or leave empty for unkeyed hashing.
Derive keys from passphrases with a KDF to hit exactly 32 bytes.
Note BLAKE3 needs a fixed (not maximum) key size.

When it happens

Trigger: Supplying a key of any length other than 32 bytes: a 16-byte key, a long passphrase, or a hex/base64 value decoding to != 32 bytes.

Common situations: Reusing a 16-byte AES key or a 64-byte BLAKE2b key as the BLAKE3 key; pasting a passphrase expecting padding; hex miscount.

Related errors

AI-assisted analysis of gchq/CyberChef@4290ea7539 (2026-08-13). Data as JSON: /api/errors/970c664d43493f79. Report an issue: GitHub.