{"record":{"id":"26ba4f1ba69bf1fe","repo":"jwtk/jjwt","slug":"the-keytype-key-s-encoded-bytes-cannot-be-null","errorCode":null,"errorMessage":"The ${keyType} key's encoded bytes cannot be null.","messagePattern":"The (.+?) key's encoded bytes cannot be null\\.","errorType":"exception","errorClass":"InvalidKeyException","httpStatus":null,"severity":"error","filePath":"api/src/main/java/io/jsonwebtoken/SignatureAlgorithm.java","lineNumber":364,"sourceCode":"\n        if (this == NONE) {\n\n            String msg = \"The 'NONE' signature algorithm does not support cryptographic keys.\";\n            throw new InvalidKeyException(msg);\n\n        } else if (isHmac()) {\n\n            if (!(key instanceof SecretKey)) {\n                String msg = this.familyName + \" \" + keyType(signing) + \" keys must be SecretKey instances.\";\n                throw new InvalidKeyException(msg);\n            }\n            SecretKey secretKey = (SecretKey) key;\n\n            byte[] encoded = EMPTY_BYTES;\n            try {\n                encoded = secretKey.getEncoded();\n                if (encoded == null) {\n                    throw new InvalidKeyException(\"The \" + keyType(signing) + \" key's encoded bytes cannot be null.\");\n                }\n\n                String alg = secretKey.getAlgorithm();\n                if (alg == null) {\n                    throw new InvalidKeyException(\"The \" + keyType(signing) + \" key's algorithm cannot be null.\");\n                }\n\n                // These next checks use equalsIgnoreCase per https://github.com/jwtk/jjwt/issues/381#issuecomment-412912272\n                if (!HS256.jcaName.equalsIgnoreCase(alg) &&\n                        !HS384.jcaName.equalsIgnoreCase(alg) &&\n                        !HS512.jcaName.equalsIgnoreCase(alg) &&\n                        !HS256.pkcs12Name.equals(alg) &&\n                        !HS384.pkcs12Name.equals(alg) &&\n                        !HS512.pkcs12Name.equals(alg)) {\n                    throw new InvalidKeyException(\"The \" + keyType(signing) + \" key's algorithm '\" + alg +\n                            \"' does not equal a valid HmacSHA* algorithm name and cannot be used with \" + name() + \".\");\n                }\n","sourceCodeStart":346,"sourceCodeEnd":382,"githubUrl":"https://github.com/jwtk/jjwt/blob/fb71496164c71442d08adec4571d9616ed5e1b8d/api/src/main/java/io/jsonwebtoken/SignatureAlgorithm.java#L346-L382","documentation":"Validation check in SignatureAlgorithm.assertValid for HMAC algorithms: after confirming the key is a SecretKey, the helper calls getEncoded() and rejects keys whose encoded form is null. Some provider-backed or hardware-backed SecretKeys (e.g. PKCS11 tokens) return null from getEncoded(), which prevents jjwt from inspecting key size, so the key is deemed unusable.","triggerScenarios":"Thrown at api/src/main/java/io/jsonwebtoken/SignatureAlgorithm.java:364 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Use a software SecretKey whose getEncoded() returns bytes, e.g. Keys.secretKeyFor(SignatureAlgorithm.HS256) or new SecretKeySpec(bytes, jcaName).","If the key comes from a keystore/HSM that cannot expose encoded bytes, extract the raw secret material at provisioning time and re-create an exportable SecretKeySpec.","Choose an algorithm family that does not need encoded bytes, or restructure key storage to keep the secret retrievable."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"fb71496164c71442d08adec4571d9616ed5e1b8d","analyzedAt":"2026-09-09T00:33:09.982Z","contentChangedAt":"2026-09-09T00:33:09.982Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}