gchq/CyberChef · error · OperationError

Unable to decrypt input with these parameters.

Error message

Unable to decrypt input with these parameters.

What it means

After feeding the data to node-forge, AESDecrypt checks decipher.finish(); a falsy return means forge could not complete decryption/authentication. This is a catch-all for any parameter mismatch that survives the earlier size checks — wrong key, wrong/missing IV, wrong mode or padding, GCM authentication-tag failure, or corrupted ciphertext. The operation cannot tell you which one, only that decryption failed.

Source

Thrown at src/core/operations/AESDecrypt.mjs:198

        /* Allow for a "no padding" mode */
        if (noPadding) {
            decipher.mode.unpad = function (output, options) {
                return true;
            };
        }

        decipher.start({
            iv: iv.length === 0 ? "" : iv,
            tag: mode === "GCM" ? gcmTag : undefined,
            additionalData: mode === "GCM" ? aad : undefined
        });
        decipher.update(forge.util.createBuffer(input));
        const result = decipher.finish();

        if (result) {
            return outputType === "Hex" ? decipher.output.toHex() : decipher.output.getBytes();
        } else {
            throw new OperationError("Unable to decrypt input with these parameters.");
        }
    }

}

export default AESDecrypt;

View on GitHub (pinned to 4290ea7539)

Solutions

1. Triple-check that key, IV, and mode string exactly match the encryption parameters.
2. For GCM, ensure the auth tag (args[6]) is correct (typically 16 bytes) and AAD (args[7]) matches what was used at encryption.
3. Confirm the input/output encoding options and that the ciphertext was not truncated by copy-paste.
4. For GCM, double-check the AAD and tag; for padded modes, verify the padding setting matches.

Example fix

// before: GCM decrypt with missing/incorrect tag, or wrong key → 'Unable to decrypt input with these parameters.'
// after: supply the exact 16-byte auth tag and AAD from encryption, and the correct key/IV

function preflightGcm(tagBytes, aadBytes) {
  if (!tagBytes || tagBytes.length !== 16) throw new Error('GCM tag must be 16 bytes');
}

function looksLikeValidCiphertext(bytes, ivLen) { return bytes.length > ivLen && (bytes.length - ivLen) % 1 === 0; }

try {
  return decryptAES(input, key, iv, mode, tag, aad);
} catch (e) {
  if (/Unable to decrypt/.test(e.message)) {
    // key/IV/mode/tag/AAD mismatch — verify against encryption params, do not blindly retry
    throw new Error('Decryption failed: check key, IV, mode, GCM tag, and AAD');
  }
  throw e;
}

When it happens

Trigger: decipher.finish() returns false. Most often: GCM mode with a missing/incorrect tag (args[6]) or AAD (args[7]); wrong key or IV relative to the ciphertext; mode/padding string (args[3]) does not match the encryption (e.g. decrypting CBC data as CFB); corrupted or truncated ciphertext after the IV was stripped.

Common situations: Decrypting with a key/IV that differs from encryption by a single byte; selecting a mode without 'NoPadding' when the data has no padding (or vice versa); GCM tag omitted; hex/base64 decoding mismatch silently changing bytes; cross-tool interop where the other tool prepended a salt/header.

Related errors

• Invalid ciphertext length: ${originalLength} bytes. Must be
• Invalid PKCS#5 padding.
• Invalid BIT padding.
• Invalid ciphertext length: ${originalLength} bytes. Must be
• Invalid key length: ${key.length} bytes The following algor

AI-assisted analysis of gchq/CyberChef@4290ea7539 (2026-08-13). Data as JSON: /api/errors/4ea21d90c069da1d. Report an issue: GitHub.