{"record":{"id":"296c77e195dc6a3b","repo":"jwtk/jjwt","slug":"the-keytype-key-s-size-is-size-bits-which-is-296c77","errorCode":null,"errorMessage":"The ${keyType} key's size is ${size} bits which is not secure enough for the ${name} algorithm.  The JWT JWA Specification (RFC 7518, Section ${section}) states that keys used with ${name} MUST have a size >= ${minKeyLength} bits.  Consider using the ${Keys} class's 'keyPairFor(SignatureAlgorithm.${name})' method to create a key pair guaranteed to be secure enough for ${name}.  See https://tools.ietf.org/html/rfc7518#section-${section} for more information.","messagePattern":"The (.+?) key's size is (.+?) bits which is not secure enough for the (.+?) algorithm\\.  The JWT JWA Specification \\(RFC 7518, Section (.+?)\\) states that keys used with (.+?) MUST have a size >= (.+?) bits\\.  Consider using the (.+?) class's 'keyPairFor\\(SignatureAlgorithm\\.(.+?)\\)' method to create a key pair guaranteed to be secure enough for (.+?)\\.  See https://tools\\.ietf\\.org/html/rfc7518#section-(.+?) for more information\\.","errorType":"exception","errorClass":"WeakKeyException","httpStatus":null,"severity":"error","filePath":"api/src/main/java/io/jsonwebtoken/SignatureAlgorithm.java","lineNumber":451,"sourceCode":"                if (!(key instanceof RSAKey)) {\n                    String msg = familyName + \" \" + keyType(signing) + \" keys must be RSAKey instances.\";\n                    throw new InvalidKeyException(msg);\n                }\n\n                RSAKey rsaKey = (RSAKey) key;\n                int size = rsaKey.getModulus().bitLength();\n                if (size < this.minKeyLength) {\n\n                    String section = name().startsWith(\"P\") ? \"3.5\" : \"3.3\";\n\n                    String msg = \"The \" + keyType(signing) + \" key's size is \" + size + \" bits which is not secure \" +\n                            \"enough for the \" + name() + \" algorithm.  The JWT JWA Specification (RFC 7518, Section \" +\n                            section + \") states that keys used with \" + name() + \" MUST have a size >= \" +\n                            this.minKeyLength + \" bits.  Consider using the \" + Keys.class.getName() + \" class's \" +\n                            \"'keyPairFor(SignatureAlgorithm.\" + name() + \")' method to create a key pair guaranteed \" +\n                            \"to be secure enough for \" + name() + \".  See \" +\n                            \"https://tools.ietf.org/html/rfc7518#section-\" + section + \" for more information.\";\n                    throw new WeakKeyException(msg);\n                }\n            }\n        }\n    }\n\n    /**\n     * Returns the recommended signature algorithm to be used with the specified key according to the following\n     * heuristics:\n     *\n     * <table>\n     * <caption>Key Signature Algorithm</caption>\n     * <thead>\n     * <tr>\n     * <th>If the Key is a:</th>\n     * <th>And:</th>\n     * <th>With a key size of:</th>\n     * <th>The returned SignatureAlgorithm will be:</th>\n     * </tr>","sourceCodeStart":433,"sourceCodeEnd":469,"githubUrl":"https://github.com/jwtk/jjwt/blob/fb71496164c71442d08adec4571d9616ed5e1b8d/api/src/main/java/io/jsonwebtoken/SignatureAlgorithm.java#L433-L469","documentation":"Error \"The ${keyType} key's size is ${size} bits which is not secure enough for the ${name} algorithm.  The JWT JWA Specification (RFC 7518, Section ${section}) states that keys used with ${name} MUST have a size >= ${minKeyLength} bits.  Consider using the ${Keys} class's 'keyPairFor(SignatureAlgorithm.${name})' method to create a key pair guaranteed to be secure enough for ${name}.  See https://tools.ietf.org/html/rfc7518#section-${section} for more information.\" thrown in jwtk/jjwt.","triggerScenarios":"Thrown at api/src/main/java/io/jsonwebtoken/SignatureAlgorithm.java:451 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Generate an RSA key pair of at least 2048 bits with Keys.keyPairFor(SignatureAlgorithm.RS256); 3072 bits for RS384/PS384 and 4096 for RS512/PS512.","Replace any 1024-bit legacy RSA keys with 2048+-bit keys and re-issue tokens.","If a smaller key must be kept, choose an RSA algorithm whose minKeyLength it satisfies (none allow <2048 for JWT use in practice)."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"fb71496164c71442d08adec4571d9616ed5e1b8d","analyzedAt":"2026-09-09T00:33:09.982Z","contentChangedAt":"2026-09-09T00:33:09.982Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}