{"record":{"id":"3bff82f1a056a714","repo":"jwtk/jjwt","slug":"the-specified-secretkey-is-not-strong-enough-to-be","errorCode":null,"errorMessage":"The specified SecretKey is not strong enough to be used with JWT HMAC signature algorithms.  The JWT specification requires HMAC keys to be >= 256 bits long.  The specified key is ${bitLength} bits.  See https://tools.ietf.org/html/rfc7518#section-3.2 for more information.","messagePattern":"The specified SecretKey is not strong enough to be used with JWT HMAC signature algorithms\\.  The JWT specification requires HMAC keys to be >= 256 bits long\\.  The specified key is (.+?) bits\\.  See https://tools\\.ietf\\.org/html/rfc7518#section-3\\.2 for more information\\.","errorType":"exception","errorClass":"WeakKeyException","httpStatus":null,"severity":"error","filePath":"api/src/main/java/io/jsonwebtoken/SignatureAlgorithm.java","lineNumber":607,"sourceCode":"            try {\n                encoded = secretKey.getEncoded();\n                bitLength = io.jsonwebtoken.lang.Arrays.length(encoded) * Byte.SIZE;\n            } finally {\n                Arrays.fill(encoded, (byte) 0);\n            }\n\n            for (SignatureAlgorithm alg : PREFERRED_HMAC_ALGS) {\n                // ensure compatibility check is based on key length. See https://github.com/jwtk/jjwt/issues/381\n                if (bitLength >= alg.minKeyLength) {\n                    return alg;\n                }\n            }\n\n            String msg = \"The specified SecretKey is not strong enough to be used with JWT HMAC signature \" +\n                    \"algorithms.  The JWT specification requires HMAC keys to be >= 256 bits long.  The specified \" +\n                    \"key is \" + bitLength + \" bits.  See https://tools.ietf.org/html/rfc7518#section-3.2 for more \" +\n                    \"information.\";\n            throw new WeakKeyException(msg);\n        }\n\n        if (key instanceof RSAKey) {\n\n            RSAKey rsaKey = (RSAKey) key;\n            int bitLength = rsaKey.getModulus().bitLength();\n\n            if (bitLength >= 4096) {\n                RS512.assertValidSigningKey(key);\n                return RS512;\n            } else if (bitLength >= 3072) {\n                RS384.assertValidSigningKey(key);\n                return RS384;\n            } else if (bitLength >= RS256.minKeyLength) {\n                RS256.assertValidSigningKey(key);\n                return RS256;\n            }\n","sourceCodeStart":589,"sourceCodeEnd":625,"githubUrl":"https://github.com/jwtk/jjwt/blob/fb71496164c71442d08adec4571d9616ed5e1b8d/api/src/main/java/io/jsonwebtoken/SignatureAlgorithm.java#L589-L625","documentation":"Error \"The specified SecretKey is not strong enough to be used with JWT HMAC signature algorithms.  The JWT specification requires HMAC keys to be >= 256 bits long.  The specified key is ${bitLength} bits.  See https://tools.ietf.org/html/rfc7518#section-3.2 for more information.\" thrown in jwtk/jjwt.","triggerScenarios":"Thrown at api/src/main/java/io/jsonwebtoken/SignatureAlgorithm.java:607 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Create a strong HMAC key with Keys.secretKeyFor(SignatureAlgorithm.HS256) or larger (384/512 bits).","If the existing secret is too short, derive a longer key (e.g. via a KDF) to reach >=256 bits rather than padding naively.","For testing only, use a fixed >=32-byte secret; do not weaken production requirements."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"fb71496164c71442d08adec4571d9616ed5e1b8d","analyzedAt":"2026-09-09T00:33:09.982Z","contentChangedAt":"2026-09-09T00:33:09.982Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}