What causes "Unable to decode JSON payload: ${e.message}" in gchq/CyberChef?

Manually decode the payload base64url segment and inspect the output to confirm it is JSON.

gchq/CyberChef · error · OperationError

Unable to decode JSON payload

Error message

Unable to decode JSON payload: ${e.message}

What it means

Thrown by the Flask Session Decode operation when JSON.parse() fails on the decoded payload string. The base64 payload of a Flask session cookie should decode to a valid JSON object. If the decoded bytes are not parseable JSON, this error fires with the specific JSON parse failure message.

Solutions

Manually decode the payload base64url segment and inspect the output to confirm it is JSON.
Re-capture the cookie to rule out truncation or corruption.
Verify the input is a genuine Flask session cookie.
Check the wrapped e.message for the specific JSON syntax error.

Example fix

// before: payload decodes to 'not json{{{' -> JSON.parse throws

// after: payload decodes to '{"user":"admin"}' -> valid JSON

Defensive patterns

Strategy: try-catch

Validate before calling

// Pre-decode and validate JSON before passing to operation
const payload = input.trim().split('.')[0];
const b64 = payload.replace(/-/g, '+').replace(/_/g, '/');
const decoded = atob(b64.padEnd(Math.ceil(b64.length / 4) * 4, '='));
JSON.parse(decoded); // throws early if invalid

Try / catch

try {
  const result = chef.flaskSessionDecode(input);
} catch (e) {
  if (e.message.startsWith('Unable to decode JSON')) {
    // Payload is not valid JSON; cookie may be corrupt or non-Flask
  } else throw e;
}

Prevention

Manually decode the payload to verify it is JSON.
Ensure the cookie was not truncated.
Confirm the cookie is from a Flask application.

When it happens

Trigger: run(input, args) at line 74 where JSON.parse(payloadJson) throws. payloadJson is the string from fromBase64(padded) and is not valid JSON.

Common situations: The payload segment decoded to non-JSON text (corrupt cookie, wrong token type, or partial decode). Also when the Flask app stores non-JSON data or the base64 decoding produced garbled output due to encoding mismatches.

Understand the failure class

Parsing and encoding errors: unexpected token, malformed input — why parsers reject input and how to find the real culprit.

Related errors

AI-assisted analysis of gchq/CyberChef@4290ea7539 (2026-08-13). Data as JSON: /api/errors/ca08275bbb88fed1. Report an issue: GitHub.

Appendix: source

Thrown at src/core/operations/FlaskSessionDecode.mjs:75

        const base64 = payloadB64.replace(/-/g, "+").replace(/_/g, "/");
        const padded = base64.padEnd(Math.ceil(base64.length / 4) * 4, "=");
        let payloadJson;
        try {
            payloadJson = fromBase64(padded);
        } catch (e) {
            throw new OperationError("Invalid Base64 payload");
        }

        try {
            let data = JSON.parse(payloadJson);

            if (args[0]) {
                data = {payload: data, timestamp: timestamp};
            }
            return data;
        } catch (e) {
            throw new OperationError("Unable to decode JSON payload: " + e.message);
        }
    }
}

export default FlaskSessionDecode;

View on GitHub (pinned to 4290ea7539)