{"record":{"id":"b8392813c09dba4d","repo":"jwtk/jjwt","slug":"the-keytype-key-s-algorithm-alg-does-not-e","errorCode":null,"errorMessage":"The ${keyType} key's algorithm '${alg}' does not equal a valid HmacSHA* algorithm name and cannot be used with ${name}.","messagePattern":"The (.+?) key's algorithm '(.+?)' does not equal a valid HmacSHA\\* algorithm name and cannot be used with (.+?)\\.","errorType":"exception","errorClass":"InvalidKeyException","httpStatus":null,"severity":"error","filePath":"api/src/main/java/io/jsonwebtoken/SignatureAlgorithm.java","lineNumber":379,"sourceCode":"            try {\n                encoded = secretKey.getEncoded();\n                if (encoded == null) {\n                    throw new InvalidKeyException(\"The \" + keyType(signing) + \" key's encoded bytes cannot be null.\");\n                }\n\n                String alg = secretKey.getAlgorithm();\n                if (alg == null) {\n                    throw new InvalidKeyException(\"The \" + keyType(signing) + \" key's algorithm cannot be null.\");\n                }\n\n                // These next checks use equalsIgnoreCase per https://github.com/jwtk/jjwt/issues/381#issuecomment-412912272\n                if (!HS256.jcaName.equalsIgnoreCase(alg) &&\n                        !HS384.jcaName.equalsIgnoreCase(alg) &&\n                        !HS512.jcaName.equalsIgnoreCase(alg) &&\n                        !HS256.pkcs12Name.equals(alg) &&\n                        !HS384.pkcs12Name.equals(alg) &&\n                        !HS512.pkcs12Name.equals(alg)) {\n                    throw new InvalidKeyException(\"The \" + keyType(signing) + \" key's algorithm '\" + alg +\n                            \"' does not equal a valid HmacSHA* algorithm name and cannot be used with \" + name() + \".\");\n                }\n\n                int size = encoded.length * 8; //size in bits\n                if (size < this.minKeyLength) {\n                    String msg = \"The \" + keyType(signing) + \" key's size is \" + size + \" bits which \" +\n                            \"is not secure enough for the \" + name() + \" algorithm.  The JWT \" +\n                            \"JWA Specification (RFC 7518, Section 3.2) states that keys used with \" + name() + \" MUST have a \" +\n                            \"size >= \" + minKeyLength + \" bits (the key size must be greater than or equal to the hash \" +\n                            \"output size).  Consider using the \" + Keys.class.getName() + \" class's \" +\n                            \"'secretKeyFor(SignatureAlgorithm.\" + name() + \")' method to create a key guaranteed to be \" +\n                            \"secure enough for \" + name() + \".  See \" +\n                            \"https://tools.ietf.org/html/rfc7518#section-3.2 for more information.\";\n                    throw new WeakKeyException(msg);\n                }\n            } finally {\n                if (encoded != null) {\n                    Arrays.fill(encoded, (byte) 0);","sourceCodeStart":361,"sourceCodeEnd":397,"githubUrl":"https://github.com/jwtk/jjwt/blob/fb71496164c71442d08adec4571d9616ed5e1b8d/api/src/main/java/io/jsonwebtoken/SignatureAlgorithm.java#L361-L397","documentation":"Algorithm-name guard in SignatureAlgorithm.assertValid for HMAC keys: the SecretKey's algorithm string is compared (case-insensitively, per jjwt issue #381) against the enum's JCA name and PKCS12 aliases (HmacSHA256/384/512 variants). A key whose algorithm is set to anything else (e.g. 'AES', 'DES') cannot be proven to be an HMAC key of the right family, so InvalidKeyException is thrown.","triggerScenarios":"Thrown at api/src/main/java/io/jsonwebtoken/SignatureAlgorithm.java:379 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Re-wrap the secret bytes with the correct algorithm: new SecretKeySpec(encoded, \"HmacSHA256\") (or 384/512 to match the chosen HS* algorithm).","Ensure the algorithm name matches one of: the enum's jcaName (e.g. HmacSHA256) or its pkcs12Name alias, case-insensitively.","If the key genuinely is an AES or other non-HMAC key, generate a dedicated HMAC key with Keys.secretKeyFor(SignatureAlgorithm.HS256)."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"fb71496164c71442d08adec4571d9616ed5e1b8d","analyzedAt":"2026-09-09T00:33:09.982Z","contentChangedAt":"2026-09-09T00:33:09.982Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}