{"record":{"id":"3ce9112e1551c27a","repo":"jwtk/jjwt","slug":"getencoded-is-disabled-for-password-instances-as","errorCode":null,"errorMessage":"getEncoded() is disabled for Password instances as they are intended to be used with key derivation algorithms only. Because passwords rarely have the length or entropy necessary for secure cryptographic operations such as authenticated hashing or encryption, they are disabled as direct inputs for these operations to help avoid accidental misuse; if you see this exception message, it is likely that the associated Password instance is being used incorrectly.","messagePattern":"getEncoded\\(\\) is disabled for Password instances as they are intended to be used with key derivation algorithms only\\. Because passwords rarely have the length or entropy necessary for secure cryptographic operations such as authenticated hashing or encryption, they are disabled as direct inputs for these operations to help avoid accidental misuse; if you see this exception message, it is likely that the associated Password instance is being used incorrectly\\.","errorType":"exception","errorClass":"UnsupportedOperationException","httpStatus":null,"severity":"error","filePath":"impl/src/main/java/io/jsonwebtoken/impl/security/PasswordSpec.java","lineNumber":68,"sourceCode":"    @Override\n    public char[] toCharArray() {\n        assertActive();\n        return this.password.clone();\n    }\n\n    @Override\n    public String getAlgorithm() {\n        return NONE_ALGORITHM;\n    }\n\n    @Override\n    public String getFormat() {\n        return null; // encoding isn't supported, so we return null per the Key#getFormat() JavaDoc\n    }\n\n    @Override\n    public byte[] getEncoded() {\n        throw new UnsupportedOperationException(ENCODED_DISABLED_MSG);\n    }\n\n    public void destroy() {\n        this.destroyed = true;\n        java.util.Arrays.fill(password, '\\u0000');\n    }\n\n    public boolean isDestroyed() {\n        return this.destroyed;\n    }\n\n    @Override\n    public int hashCode() {\n        return Objects.nullSafeHashCode(this.password);\n    }\n\n    @Override\n    public boolean equals(Object obj) {","sourceCodeStart":50,"sourceCodeEnd":86,"githubUrl":"https://github.com/jwtk/jjwt/blob/fb71496164c71442d08adec4571d9616ed5e1b8d/impl/src/main/java/io/jsonwebtoken/impl/security/PasswordSpec.java#L50-L86","documentation":"Password implements Key but deliberately disables getEncoded(): passwords must only feed password-based key-derivation functions (e.g. PBKDF2), not be used directly as raw key material for hashing or encryption. Calling getEncoded() throws UnsupportedOperationException with this long explanatory message.","triggerScenarios":"Passing a Password instance where a regular encoded Key is expected — e.g. encrypting/hashing directly with the password, serializing it, or handing it to APIs that call getEncoded().","commonSituations":"Using a password directly with a cipher/MAC instead of deriving a key via a PBES2 algorithm; generic code that inspects key.getEncoded() for logging or key comparison.","solutions":["Derive an actual key first, e.g. via Jwts.SIG.PBES2-HS256+A128KW for JWE, or Keys.builder(password)... / SecretKeyFactory PBKDF2, then use the derived SecretKey.","Use the Password only with password-based algorithms that accept char[] input.","Refactor helper code that assumes Key.getEncoded() is always available."],"exampleFix":"// before\ncipher.init(Cipher.ENCRYPT_MODE, password);\n// after\nSecretKey derived = Jwts.SIG.PBES2_HS256_A128KW.key(new SecureRandom())\n    ... // or use KDF\nSecretKey k = Keys.password(pwdChars).derive(...);","handlingStrategy":"try-catch","validationCode":"if (key instanceof Password) {\n    throw new IllegalArgumentException(\"Use a derived SecretKey, not a raw Password, here\");\n}","typeGuard":"boolean isDerivedKey(Key k) { return k instanceof SecretKey && !(k instanceof Password); }","tryCatchPattern":"try {\n    cipher.init(Cipher.ENCRYPT_MODE, key);\n} catch (UnsupportedOperationException e) {\n    // Password used where only derived keys are allowed\n}","preventionTips":["Never use passwords directly as cipher keys","Always pass passwords through a PBKDF (PBES2/PBKDF2) first","Read Password API docs — getEncoded/destroy semantics are intentional"],"tags":["password","security","keys"],"backgroundTag":"unsupported-operation","analyzedSha":"fb71496164c71442d08adec4571d9616ed5e1b8d","analyzedAt":"2026-09-09T00:33:09.982Z","contentChangedAt":"2026-09-09T00:33:09.982Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}