{"record":{"id":"3340f8d2efea4232","repo":"jwtk/jjwt","slug":"the-keytype-key-s-algorithm-cannot-be-null","errorCode":null,"errorMessage":"The ${keyType} key's algorithm cannot be null.","messagePattern":"The (.+?) key's algorithm cannot be null\\.","errorType":"exception","errorClass":"InvalidKeyException","httpStatus":null,"severity":"error","filePath":"api/src/main/java/io/jsonwebtoken/SignatureAlgorithm.java","lineNumber":369,"sourceCode":"\n        } else if (isHmac()) {\n\n            if (!(key instanceof SecretKey)) {\n                String msg = this.familyName + \" \" + keyType(signing) + \" keys must be SecretKey instances.\";\n                throw new InvalidKeyException(msg);\n            }\n            SecretKey secretKey = (SecretKey) key;\n\n            byte[] encoded = EMPTY_BYTES;\n            try {\n                encoded = secretKey.getEncoded();\n                if (encoded == null) {\n                    throw new InvalidKeyException(\"The \" + keyType(signing) + \" key's encoded bytes cannot be null.\");\n                }\n\n                String alg = secretKey.getAlgorithm();\n                if (alg == null) {\n                    throw new InvalidKeyException(\"The \" + keyType(signing) + \" key's algorithm cannot be null.\");\n                }\n\n                // These next checks use equalsIgnoreCase per https://github.com/jwtk/jjwt/issues/381#issuecomment-412912272\n                if (!HS256.jcaName.equalsIgnoreCase(alg) &&\n                        !HS384.jcaName.equalsIgnoreCase(alg) &&\n                        !HS512.jcaName.equalsIgnoreCase(alg) &&\n                        !HS256.pkcs12Name.equals(alg) &&\n                        !HS384.pkcs12Name.equals(alg) &&\n                        !HS512.pkcs12Name.equals(alg)) {\n                    throw new InvalidKeyException(\"The \" + keyType(signing) + \" key's algorithm '\" + alg +\n                            \"' does not equal a valid HmacSHA* algorithm name and cannot be used with \" + name() + \".\");\n                }\n\n                int size = encoded.length * 8; //size in bits\n                if (size < this.minKeyLength) {\n                    String msg = \"The \" + keyType(signing) + \" key's size is \" + size + \" bits which \" +\n                            \"is not secure enough for the \" + name() + \" algorithm.  The JWT \" +\n                            \"JWA Specification (RFC 7518, Section 3.2) states that keys used with \" + name() + \" MUST have a \" +","sourceCodeStart":351,"sourceCodeEnd":387,"githubUrl":"https://github.com/jwtk/jjwt/blob/fb71496164c71442d08adec4571d9616ed5e1b8d/api/src/main/java/io/jsonwebtoken/SignatureAlgorithm.java#L351-L387","documentation":"Validation check in SignatureAlgorithm.assertValid for HMAC algorithms: after obtaining the SecretKey's encoded bytes, the helper reads getAlgorithm() and rejects a null algorithm name. The name is required because the subsequent check verifies it matches a valid HmacSHA* JCA name; a SecretKey created without an algorithm string cannot be validated and throws InvalidKeyException.","triggerScenarios":"Thrown at api/src/main/java/io/jsonwebtoken/SignatureAlgorithm.java:369 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Construct the SecretKey with an explicit algorithm, e.g. new SecretKeySpec(bytes, \"HmacSHA256\").","Re-wrap provider-supplied keys with a SecretKeySpec carrying the correct HmacSHA* name before calling signWith/assertValid.","Match the algorithm name exactly to the enum's JCA name (HmacSHA256/384/512) or its PKCS12 alias."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"fb71496164c71442d08adec4571d9616ed5e1b8d","analyzedAt":"2026-09-09T00:33:09.982Z","contentChangedAt":"2026-09-09T00:33:09.982Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}