{"record":{"id":"377c4a17af24cee1","repo":"jwtk/jjwt","slug":"byte-array-must-be-at-least-bitsmsg-this-bitleng","errorCode":null,"errorMessage":"Byte array must be at least ${bitsMsg(this.bitLength)}. Found ${bitsMsg(len)}","messagePattern":"Byte array must be at least (.+?)\\. Found (.+?)","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"impl/src/main/java/io/jsonwebtoken/impl/lang/RequiredBitLengthConverter.java","lineNumber":44,"sourceCode":"\n    public RequiredBitLengthConverter(Converter<byte[], Object> converter, int bitLength) {\n        this(converter, bitLength, true);\n    }\n\n    public RequiredBitLengthConverter(Converter<byte[], Object> converter, int bitLength, boolean exact) {\n        this.converter = Assert.notNull(converter, \"Converter cannot be null.\");\n        this.bitLength = Assert.gt(bitLength, 0, \"bitLength must be greater than 0\");\n        this.exact = exact;\n    }\n\n    private byte[] assertLength(byte[] bytes) {\n        long len = Bytes.bitLength(bytes);\n        if (exact && len != this.bitLength) {\n            String msg = \"Byte array must be exactly \" + Bytes.bitsMsg(this.bitLength) + \". Found \" + Bytes.bitsMsg(len);\n            throw new IllegalArgumentException(msg);\n        } else if (len < this.bitLength) {\n            String msg = \"Byte array must be at least \" + Bytes.bitsMsg(this.bitLength) + \". Found \" + Bytes.bitsMsg(len);\n            throw new IllegalArgumentException(msg);\n        }\n        return bytes;\n    }\n\n    @Override\n    public Object applyTo(byte[] bytes) {\n        assertLength(bytes);\n        return this.converter.applyTo(bytes);\n    }\n\n    @Override\n    public byte[] applyFrom(Object o) {\n        byte[] result = this.converter.applyFrom(o);\n        return assertLength(result);\n    }\n}\n","sourceCodeStart":26,"sourceCodeEnd":61,"githubUrl":"https://github.com/jwtk/jjwt/blob/fb71496164c71442d08adec4571d9616ed5e1b8d/impl/src/main/java/io/jsonwebtoken/impl/lang/RequiredBitLengthConverter.java#L26-L61","documentation":"RequiredBitLengthConverter.assertLength also enforces a minimum: when the converter is non-exact, a byte array whose bit length is less than the configured bitLength triggers this IllegalArgumentException stating the minimum required bits and the actual found bits.","triggerScenarios":"Supplying a too-short byte array where at least bitLength bits are required, e.g. a 64-bit value where the claim demands >= 128 bits.","commonSituations":"Using short/weak secrets as keys; truncated hashes; mistaken units (passing 16 bytes where 16 bits were thought sufficient, or vice versa).","solutions":["Increase the array length so len >= requiredBits (e.g. use a full digest output instead of a truncated one).","Generate keys of adequate size for the algorithm (256-bit keys for HS256, etc.).","Validate byte array length before passing it in."],"exampleFix":"// before\nbyte[] key = \"secret\".getBytes(); // 48 bits\n// after\nbyte[] key = new byte[32]; // 256 bits, e.g. from a secure random generator","handlingStrategy":"validation","validationCode":"void requireMinBits(byte[] b, long bits) {\n    long len = b.length * 8L;\n    if (len < bits) throw new IllegalArgumentException(\"Need at least \" + bits + \" bits, got \" + len);\n}","typeGuard":null,"tryCatchPattern":"try {\n    converter.applyTo(bytes);\n} catch (IllegalArgumentException e) {\n    if (e.getMessage() != null && e.getMessage().startsWith(\"Byte array must be at least\")) {\n        // supply longer key material\n    }\n    throw e;\n}","preventionTips":["Use algorithm-appropriate key sizes (>= 256-bit for HS256)","Avoid truncated hashes or short passwords as key material","Check byte-array size at load/config time, before signing"],"tags":["byte-array","key-length","validation"],"backgroundTag":"value-out-of-range","analyzedSha":"fb71496164c71442d08adec4571d9616ed5e1b8d","analyzedAt":"2026-09-09T00:33:09.982Z","contentChangedAt":"2026-09-09T00:33:09.982Z","schemaVersion":2},"datasetVersion":"2026-09-14T11:17:12.474Z"}