{"record":{"id":"93c6286c099513b0","repo":"jwtk/jjwt","slug":"the-specified-key-byte-array-is-bits-which-is-not","errorCode":null,"errorMessage":"The specified key byte array is  bits which is not secure enough for any JWT HMAC-SHA algorithm.  The JWT JWA Specification (RFC 7518, Section 3.2) states that keys used with HMAC-SHA algorithms MUST have a size >= 256 bits (the key size must be greater than or equal to the hash output size).  Consider using the Jwts.SIG.HS256.key() builder (or HS384.key() or HS512.key()) to create a key guaranteed to be secure enough for your preferred HMAC-SHA algorithm.  See https://tools.ietf.org/html/rfc7518#section-3.2 for more information.","messagePattern":"The specified key byte array is  bits which is not secure enough for any JWT HMAC-SHA algorithm\\.  The JWT JWA Specification \\(RFC 7518, Section 3\\.2\\) states that keys used with HMAC-SHA algorithms MUST have a size >= 256 bits \\(the key size must be greater than or equal to the hash output size\\)\\.  Consider using the Jwts\\.SIG\\.HS256\\.key\\(\\) builder \\(or HS384\\.key\\(\\) or HS512\\.key\\(\\)\\) to create a key guaranteed to be secure enough for your preferred HMAC-SHA algorithm\\.  See https://tools\\.ietf\\.org/html/rfc7518#section-3\\.2 for more information\\.","errorType":"exception","errorClass":"WeakKeyException","httpStatus":null,"severity":"critical","filePath":"api/src/main/java/io/jsonwebtoken/security/Keys.java","lineNumber":83,"sourceCode":"        int bitLength = bytes.length * 8;\n\n        //Purposefully ordered higher to lower to ensure the strongest key possible can be generated.\n        if (bitLength >= 512) {\n            return new SecretKeySpec(bytes, \"HmacSHA512\");\n        } else if (bitLength >= 384) {\n            return new SecretKeySpec(bytes, \"HmacSHA384\");\n        } else if (bitLength >= 256) {\n            return new SecretKeySpec(bytes, \"HmacSHA256\");\n        }\n\n        String msg = \"The specified key byte array is \" + bitLength + \" bits which \" +\n                \"is not secure enough for any JWT HMAC-SHA algorithm.  The JWT \" +\n                \"JWA Specification (RFC 7518, Section 3.2) states that keys used with HMAC-SHA algorithms MUST have a \" +\n                \"size >= 256 bits (the key size must be greater than or equal to the hash \" +\n                \"output size).  Consider using the Jwts.SIG.HS256.key() builder (or HS384.key() \" +\n                \"or HS512.key()) to create a key guaranteed to be secure enough for your preferred HMAC-SHA \" +\n                \"algorithm.  See https://tools.ietf.org/html/rfc7518#section-3.2 for more information.\";\n        throw new WeakKeyException(msg);\n    }\n\n    /**\n     * <p><b>Deprecation Notice</b></p>\n     *\n     * <p>As of JJWT 0.12.0, symmetric (secret) key algorithm instances can generate a key of suitable\n     * length for that specific algorithm by calling their {@code key()} builder method directly. For example:</p>\n     *\n     * <pre><code>\n     * {@link Jwts.SIG#HS256}.key().build();\n     * {@link Jwts.SIG#HS384}.key().build();\n     * {@link Jwts.SIG#HS512}.key().build();\n     * </code></pre>\n     *\n     * <p>Call those methods as needed instead of this static {@code secretKeyFor} helper method - the returned\n     * {@link KeyBuilder} allows callers to specify a preferred Provider or SecureRandom on the builder if\n     * desired, whereas this {@code secretKeyFor} method does not. Consequently this helper method will be removed\n     * before the 1.0 release.</p>","sourceCodeStart":65,"sourceCodeEnd":101,"githubUrl":"https://github.com/jwtk/jjwt/blob/fb71496164c71442d08adec4571d9616ed5e1b8d/api/src/main/java/io/jsonwebtoken/security/Keys.java#L65-L101","documentation":"Keys.hmacShaKeyFor throws WeakKeyException when the supplied key byte array is shorter than 256 bits (32 bytes), which RFC 7518 §3.2 forbids for JWT HMAC-SHA algorithms. This is a deliberate security guard — weak keys make MAC forgery feasible.","triggerScenarios":"Calling Keys.hmacShaKeyFor(bytes) where bytes.length * 8 < 512 bits fails the strongest checks and anything below 256 bits triggers this error — practically, passing a secret shorter than 32 bytes (e.g. \"mysecret\", a short password, or a truncated Base64 blob).","commonSituations":"Using a human-readable password as the JWT secret, hard-coded short demo secrets in production, or an env var silently cut off / partially loaded.","solutions":["Generate a key of at least 256 bits: Keys.secretKeyFor(SignatureAlgorithm.HS256) or Jwts.SIG.HS256.key().build()","Use a random secret of >= 32 bytes, e.g. Base64 of 32+ random bytes","Verify key length before calling: if (bytes.length < 32) fail at startup","Persist the generated strong key securely (secret manager, vault) rather than a short string"],"exampleFix":"// before\nSecretKey key = Keys.hmacShaKeyFor(\"secret\".getBytes()); // WeakKeyException\n// after\nSecretKey key = Keys.secretKeyFor(io.jsonwebtoken.SignatureAlgorithm.HS256);\nString encoded = Base64.getEncoder().encodeToString(key.getEncoded()); // store securely","handlingStrategy":"validation","validationCode":"if (secretBytes == null || secretBytes.length < 32) {\n    throw new IllegalStateException(\"JWT HMAC secret must be at least 256 bits (32 bytes)\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    key = Keys.hmacShaKeyFor(secretBytes);\n} catch (WeakKeyException e) {\n    throw new IllegalStateException(\"Refusing weak JWT secret; generate with Keys.secretKeyFor(HS256)\", e);\n}","preventionTips":["Generate secrets with Keys.secretKeyFor(SignatureAlgorithm.HS256) or a CSPRNG of >= 32 bytes","Never use passwords, names, or short literals as HMAC secrets","Store generated keys in a secret manager and rotate securely","Add a startup length check so weak keys fail before serving traffic"],"tags":["java","jjwt","security","weak-key","hmac"],"backgroundTag":"weak-hmac-key","analyzedSha":"fb71496164c71442d08adec4571d9616ed5e1b8d","analyzedAt":"2026-09-09T00:33:09.982Z","contentChangedAt":"2026-09-09T00:33:09.982Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}