Blankj/AndroidUtilCode · info · UnsupportedOperationException

u can't instantiate me...

Error message

u can't instantiate me...

What it means

EncryptUtils is a final utility class whose private constructor throws UnsupportedOperationException("u can't instantiate me..."). Every hash/symmetric/asymmetric/hmac routine is static, so no instance is needed; the constructor exists purely to block instantiation, matching the *Utils convention used throughout the library.

Source

Thrown at lib/utilcode/src/main/java/com/blankj/utilcode/util/EncryptUtils.java:37

import javax.crypto.Mac;
import javax.crypto.SecretKey;
import javax.crypto.SecretKeyFactory;
import javax.crypto.spec.DESKeySpec;
import javax.crypto.spec.IvParameterSpec;
import javax.crypto.spec.SecretKeySpec;

/**
 * <pre>
 *     author: Blankj
 *     blog  : http://blankj.com
 *     time  : 2016/08/02
 *     desc  : utils about encrypt
 * </pre>
 */
public final class EncryptUtils {

    private EncryptUtils() {
        throw new UnsupportedOperationException("u can't instantiate me...");
    }

    ///////////////////////////////////////////////////////////////////////////
    // hash encryption
    ///////////////////////////////////////////////////////////////////////////

    /**
     * Return the hex string of MD2 encryption.
     *
     * @param data The data.
     * @return the hex string of MD2 encryption
     */
    public static String encryptMD2ToString(final String data) {
        if (data == null || data.length() == 0) return "";
        return encryptMD2ToString(data.getBytes());
    }

    /**

View on GitHub (pinned to 7b4caf9e54)

Solutions

  1. Call the static API directly: EncryptUtils.encryptMD5ToString(...), EncryptUtils.encryptAES(...), etc.
  2. Configure any reflective instantiation tool to skip final classes or specifically exclude EncryptUtils.
  3. In a contract unit test, assert UnsupportedOperationException is thrown rather than using the instance.

Example fix

// before (reflection)
EncryptUtils eu = EncryptUtils.class.getDeclaredConstructor().newInstance();

// after
String md5 = EncryptUtils.encryptMD5ToString("data");
Defensive patterns

Strategy: validation

Validate before calling

// Never construct EncryptUtils; it is static-only.
if (clazz == EncryptUtils.class || Modifier.isFinal(clazz.getModifiers())) {
    // skip instantiation; use EncryptUtils.xxx() statically
}

Type guard

if (clazz.getName().endsWith("Utils") && Modifier.isFinal(clazz.getModifiers())) {
    // static-only; do not newInstance()
}

Try / catch

try {
    Constructor<?> c = EncryptUtils.class.getDeclaredConstructor();
    c.setAccessible(true);
    c.newInstance();
} catch (UnsupportedOperationException e) {
    // expected; use EncryptUtils.xxx() instead
}

Prevention

When it happens

Trigger: Reflective instantiation via getDeclaredConstructor().newInstance() with setAccessible, or handing the Class to a reflective factory. A plain `new EncryptUtils()` is a compile error because the constructor is private.

Common situations: Coverage tooling that walks and instantiates classes; DI containers that scan packages; a developer who assumes instance methods; mutation testing that targets constructors.

Related errors

AI-assisted analysis of Blankj/AndroidUtilCode@7b4caf9e54 (2026-08-14). Data as JSON: /api/errors/4e3039b7de6d7e8e. Report an issue: GitHub.