{"record":{"id":"9a1effc38cae84cd","repo":"jwtk/jjwt","slug":"the-none-signature-algorithm-does-not-support-cr","errorCode":null,"errorMessage":"The 'NONE' signature algorithm does not support cryptographic keys.","messagePattern":"The 'NONE' signature algorithm does not support cryptographic keys\\.","errorType":"exception","errorClass":"InvalidKeyException","httpStatus":null,"severity":"error","filePath":"api/src/main/java/io/jsonwebtoken/SignatureAlgorithm.java","lineNumber":350,"sourceCode":"        assertValid(key, false);\n    }\n\n    /**\n     * @since 0.10.0 to support assertValid(Key, boolean)\n     */\n    private static String keyType(boolean signing) {\n        return signing ? \"signing\" : \"verification\";\n    }\n\n    /**\n     * @since 0.10.0\n     */\n    private void assertValid(Key key, boolean signing) throws InvalidKeyException {\n\n        if (this == NONE) {\n\n            String msg = \"The 'NONE' signature algorithm does not support cryptographic keys.\";\n            throw new InvalidKeyException(msg);\n\n        } else if (isHmac()) {\n\n            if (!(key instanceof SecretKey)) {\n                String msg = this.familyName + \" \" + keyType(signing) + \" keys must be SecretKey instances.\";\n                throw new InvalidKeyException(msg);\n            }\n            SecretKey secretKey = (SecretKey) key;\n\n            byte[] encoded = EMPTY_BYTES;\n            try {\n                encoded = secretKey.getEncoded();\n                if (encoded == null) {\n                    throw new InvalidKeyException(\"The \" + keyType(signing) + \" key's encoded bytes cannot be null.\");\n                }\n\n                String alg = secretKey.getAlgorithm();\n                if (alg == null) {","sourceCodeStart":332,"sourceCodeEnd":368,"githubUrl":"https://github.com/jwtk/jjwt/blob/fb71496164c71442d08adec4571d9616ed5e1b8d/api/src/main/java/io/jsonwebtoken/SignatureAlgorithm.java#L332-L368","documentation":"Generic sentinel guard in SignatureAlgorithm.assertValid: it fires whenever a caller passes a Key to NONE, the unsigned/no-signature algorithm. NONE performs no JCA signature, so any cryptographic key (SecretKey, PrivateKey, PublicKey) is invalid for it; the helper rejects the input before any key-type or size checks run.","triggerScenarios":"Thrown at api/src/main/java/io/jsonwebtoken/SignatureAlgorithm.java:350 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Do not pass a key at all when using SignatureAlgorithm.NONE; build the JWT unsigned with .signWith.NONE or compact it without a signature as the JWS 'alg':'none' use case requires.","If a signature is intended, select the correct algorithm (e.g. HS256, RS256) matching the key type instead of NONE.","Wrap key configuration in validation so NONE is never combined with a Key argument."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"fb71496164c71442d08adec4571d9616ed5e1b8d","analyzedAt":"2026-09-09T00:33:09.982Z","contentChangedAt":"2026-09-09T00:33:09.982Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}