{"record":{"id":"91d48783a6995970","repo":"jwtk/jjwt","slug":"the-algorithm-does-not-support-key-pairs","errorCode":null,"errorMessage":"The  algorithm does not support Key Pairs.","messagePattern":"The  algorithm does not support Key Pairs\\.","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"api/src/main/java/io/jsonwebtoken/security/Keys.java","lineNumber":250,"sourceCode":"     * <td>{@code secp521r1}</td>\n     * </tr>\n     * </table>\n     *\n     * @param alg the {@code SignatureAlgorithm} to inspect to determine which asymmetric algorithm to use.\n     * @return a new {@link KeyPair} suitable for use with the specified asymmetric algorithm.\n     * @throws IllegalArgumentException if {@code alg} is not an asymmetric algorithm\n     * @deprecated since 0.12.0 in favor of your preferred\n     * {@link io.jsonwebtoken.security.SignatureAlgorithm} instance's\n     * {@link SignatureAlgorithm#keyPair() keyPair()} builder method directly.\n     */\n    @SuppressWarnings(\"DeprecatedIsStillUsed\")\n    @Deprecated\n    public static KeyPair keyPairFor(io.jsonwebtoken.SignatureAlgorithm alg) throws IllegalArgumentException {\n        Assert.notNull(alg, \"SignatureAlgorithm cannot be null.\");\n        SecureDigestAlgorithm<?, ?> salg = Jwts.SIG.get().get(alg.name());\n        if (!(salg instanceof SignatureAlgorithm)) {\n            String msg = \"The \" + alg.name() + \" algorithm does not support Key Pairs.\";\n            throw new IllegalArgumentException(msg);\n        }\n        SignatureAlgorithm asalg = ((SignatureAlgorithm) salg);\n        return asalg.keyPair().build();\n    }\n\n    /**\n     * Returns a new {@link Password} instance suitable for use with password-based key derivation algorithms.\n     *\n     * <p><b>Usage Note</b>: Using {@code Password}s outside of key derivation contexts will likely\n     * fail. See the {@link Password} JavaDoc for more, and also note the <b>Password Safety</b> section below.</p>\n     *\n     * <p><b>Password Safety</b></p>\n     *\n     * <p>Instances returned by this method use a <em>clone</em> of the specified {@code password} character array\n     * argument - changes to the argument array will NOT be reflected in the returned key, and vice versa.  If you wish\n     * to clear a {@code Password} instance to ensure it is no longer usable, call its {@link Password#destroy()}\n     * method will clear/overwrite its internal cloned char array. Also note that each subsequent call to\n     * {@link Password#toCharArray()} will also return a new clone of the underlying password character array per","sourceCodeStart":232,"sourceCodeEnd":268,"githubUrl":"https://github.com/jwtk/jjwt/blob/fb71496164c71442d08adec4571d9616ed5e1b8d/api/src/main/java/io/jsonwebtoken/security/Keys.java#L232-L268","documentation":"Deprecated Keys.keyPairFor(SignatureAlgorithm) throws IllegalArgumentException when the given algorithm is not an asymmetric signature algorithm, i.e. an HMAC algorithm like HS256 was requested as a KeyPair. MAC algorithms have no public/private pair.","triggerScenarios":"Calling Keys.keyPairFor(SignatureAlgorithm.HS256) (or HS384/HS512) — the resolved SecureDigestAlgorithm is a MacAlgorithm, not the (new) SignatureAlgorithm interface, so key pair creation is rejected.","commonSituations":"Generic code that generates a key pair for any SignatureAlgorithm value; mixing HMAC and asymmetric algorithm constants; migration to 0.12.x where Jwts.SIG instances are used.","solutions":["Only call keyPairFor with asymmetric algorithms: RS256/RS384/RS512, PS256..PS512, ES256/ES384/ES512, EdDSA","Use Keys.secretKeyFor(alg) or Jwts.SIG.HS256.key().build() for HMAC algorithms","Guard with a check: if the algorithm name starts with \"HS\", generate a secret key instead","Migrate to Jwts.SIG.<Alg>.keyPair().build() modern builder API"],"exampleFix":"// before\nKeyPair kp = Keys.keyPairFor(SignatureAlgorithm.HS256); // throws\n// after\nSecretKey key = Keys.secretKeyFor(SignatureAlgorithm.HS256); // HMAC has no keypair\nKeyPair kp = Keys.keyPairFor(SignatureAlgorithm.RS256); // asymmetric path","handlingStrategy":"type-guard","validationCode":"if (alg.name().startsWith(\"HS\")) throw new IllegalArgumentException(alg + \" is HMAC; use secretKeyFor\");","typeGuard":"static boolean isAsymmetric(io.jsonwebtoken.SignatureAlgorithm alg) {\n    return alg != null && !alg.name().startsWith(\"HS\");\n}","tryCatchPattern":"try {\n    KeyPair kp = Keys.keyPairFor(alg);\n} catch (IllegalArgumentException e) {\n    SecretKey sk = Keys.secretKeyFor(alg); // fall back to symmetric generation\n}","preventionTips":["Validate algorithm family before key-pair generation in generic code paths","Migrate to Jwts.SIG instances where MacAlgorithm vs SignatureAlgorithm typing makes misuse a compile error","Document which SignatureAlgorithm constants are symmetric in shared utility APIs"],"tags":["java","jjwt","deprecated-api","key-generation"],"backgroundTag":"deprecated-api-usage","analyzedSha":"fb71496164c71442d08adec4571d9616ed5e1b8d","analyzedAt":"2026-09-09T00:33:09.982Z","contentChangedAt":"2026-09-09T00:33:09.982Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}