{"record":{"id":"691fbd7822ac0110","repo":"jwtk/jjwt","slug":"bitlength-must-be-an-even-multiple-of-8","errorCode":null,"errorMessage":"bitLength must be an even multiple of 8","messagePattern":"bitLength must be an even multiple of 8","errorType":"validation","errorClass":"java.lang.IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"impl/src/main/java/io/jsonwebtoken/impl/security/DefaultSecretKeyBuilder.java","lineNumber":36,"sourceCode":"import io.jsonwebtoken.lang.Assert;\nimport io.jsonwebtoken.security.SecretKeyBuilder;\n\nimport javax.crypto.SecretKey;\n\n/**\n * @since 0.12.0\n */\npublic class DefaultSecretKeyBuilder extends AbstractSecurityBuilder<SecretKey, SecretKeyBuilder>\n        implements SecretKeyBuilder {\n\n    protected final String JCA_NAME;\n    protected final int BIT_LENGTH;\n\n    public DefaultSecretKeyBuilder(String jcaName, int bitLength) {\n        this.JCA_NAME = Assert.hasText(jcaName, \"jcaName cannot be null or empty.\");\n        if (bitLength % Byte.SIZE != 0) {\n            String msg = \"bitLength must be an even multiple of 8\";\n            throw new IllegalArgumentException(msg);\n        }\n        this.BIT_LENGTH = Assert.gt(bitLength, 0, \"bitLength must be > 0\");\n        random(Randoms.secureRandom());\n    }\n\n    @Override\n    public SecretKey build() {\n        JcaTemplate template = new JcaTemplate(JCA_NAME, this.provider, this.random);\n        return template.generateSecretKey(this.BIT_LENGTH);\n    }\n}\n","sourceCodeStart":18,"sourceCodeEnd":48,"githubUrl":"https://github.com/jwtk/jjwt/blob/fb71496164c71442d08adec4571d9616ed5e1b8d/impl/src/main/java/io/jsonwebtoken/impl/security/DefaultSecretKeyBuilder.java#L18-L48","documentation":"DefaultSecretKeyBuilder requires bitLength to be a whole number of bytes (an even multiple of 8, via Byte.SIZE) so it can construct a SecretKey of exact byte length. A bit length not divisible by 8 cannot be represented cleanly as a byte array, so the constructor throws IllegalArgumentException immediately.","triggerScenarios":"Instantiating a secret key builder subclass or calling a builder API with bitLength values like 100, 127, or 521; typically from custom MAC/direct key algorithm code that passes an odd bit size.","commonSituations":"Typos in bit sizes (e.g. 127 instead of 128), using curve-style bit sizes (521) for symmetric keys, or programmatic computation producing a non-multiple-of-8 value.","solutions":["Pass a bit length divisible by 8 (e.g. 128, 192, 256).","Compute the size from bytes and multiply: bytes * 8.","Validate the value before constructing the builder."],"exampleFix":"// before\nnew DefaultSecretKeyBuilder(\"AES\", 127);\n// after\nnew DefaultSecretKeyBuilder(\"AES\", 128);","handlingStrategy":"validation","validationCode":"if (bitLength <= 0 || bitLength % 8 != 0) {\n    throw new IllegalArgumentException(\"bitLength must be a positive multiple of 8\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    builder = new MySecretKeyBuilder(\"AES\", bitLength);\n} catch (IllegalArgumentException e) {\n    // correct bitLength to the nearest byte multiple\n}","preventionTips":["Use standard symmetric sizes: 128, 192, 256 bits","Derive bit length from byte counts (bytes * 8)"],"tags":["java","jjwt","secret-key","argument-validation"],"backgroundTag":"invalid-argument-value","analyzedSha":"fb71496164c71442d08adec4571d9616ed5e1b8d","analyzedAt":"2026-09-09T00:33:09.982Z","contentChangedAt":"2026-09-09T00:33:09.982Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}