gchq/CyberChef · error · OperationError

${verified.message}

Error message

${verified.message}

What it means

Thrown by JWT Verify on a specific code path where jsonwebtoken's verify() returns (rather than throws) an object whose name is 'JsonWebTokenError'. The operation detects this returned-error shape and re-throws verified.message. This covers structural/signature JWT errors such as 'jwt malformed' or 'invalid signature' in library versions that return instead of throw.

Source

Thrown at src/core/operations/JWTVerify.mjs:52

            },
        ];
    }

    /**
     * @param {string} input
     * @param {Object[]} args
     * @returns {string}
     */
    run(input, args) {
        const [key] = args;
        const algos = JWT_ALGORITHMS;
        algos[algos.indexOf("None")] = "none";

        try {
            const verified = jwt.verify(input, key, { algorithms: algos });

            if (Object.prototype.hasOwnProperty.call(verified, "name") && verified.name === "JsonWebTokenError") {
                throw new OperationError(verified.message);
            }

            return verified;
        } catch (err) {
            throw new OperationError(err);
        }
    }

}

export default JWTVerify;

View on GitHub (pinned to 4290ea7539)

Solutions

1. Provide the exact secret (HMAC) or PEM public key (RSA/ECDSA) the token was signed with.
2. Ensure the token's alg is in the allowed algorithm set.
3. Re-sign the token with the key you control and re-verify to isolate key vs token problems.
4. Upgrade/align jsonwebtoken versions if the returned-error behavior is inconsistent.

Example fix

// before: wrong secret
chef.JWTVerify(token, { key: 'wrong-secret' });
// after: correct secret used to sign
chef.JWTVerify(token, { key: 'correct-secret' });

function preflightVerify(token, key, algos) {
  if (typeof token !== 'string' || token.split('.').length !== 3)
    throw new Error('Not a compact JWT');
  if (!key) throw new Error('A secret/public key is required');
}

function isVerifiableToken(s) {
  return typeof s === 'string' && s.split('.').length === 3 &&
    s.split('.').every(p => /^[A-Za-z0-9_-]*$/.test(p));
}

try {
  return chef.JWTVerify(token, { key });
} catch (e) {
  if (/invalid signature|jwt malformed/i.test(String(e.message)))
    throw new Error('Signature/key mismatch or malformed token');
  throw e;
}

When it happens

Trigger: A token with an invalid signature (wrong key). A malformed token that the library surfaces as a returned JsonWebTokenError rather than a thrown one. Token where the algorithm is not in the allowed list and the library returns the error object.

Common situations: Verifying with the wrong secret/key. Verifying a token signed with an algorithm excluded from the allowed list. Library version differences where some errors are returned vs thrown.

Related errors

• Error: Have you entered the key correctly? The key should be
• ${err}
• Input is not a JSON Web Key
• Invalid JWK format
• Unsupported JWK key type '${inputJson.kty}'

AI-assisted analysis of gchq/CyberChef@4290ea7539 (2026-08-13). Data as JSON: /api/errors/60e6117deb03b71d. Report an issue: GitHub.