{"record":{"id":"f9cdf5c1292cf7cd","repo":"jwtk/jjwt","slug":"the-keytype-key-s-size-is-size-bits-which-is","errorCode":null,"errorMessage":"The ${keyType} key's size is ${size} bits which is not secure enough for the ${name} algorithm.  The JWT JWA Specification (RFC 7518, Section 3.2) states that keys used with ${name} MUST have a size >= ${minKeyLength} bits (the key size must be greater than or equal to the hash output size).  Consider using the ${Keys} class's 'secretKeyFor(SignatureAlgorithm.${name})' method to create a key guaranteed to be secure enough for ${name}.  See https://tools.ietf.org/html/rfc7518#section-3.2 for more information.","messagePattern":"The \\$\\{keyType\\} key's size is \\$\\{size\\} bits which is not secure enough for the \\$\\{name\\} algorithm\\.  The JWT JWA Specification \\(RFC 7518, Section 3\\.2\\) states that keys used with \\$\\{name\\} MUST have a size >= \\$\\{minKeyLength\\} bits \\(the key size must be greater than or equal to the hash output size\\)\\.  Consider using the \\$\\{Keys\\} class's 'secretKeyFor\\(SignatureAlgorithm\\.\\$\\{name\\}\\)' method to create a key guaranteed to be secure enough for \\$\\{name\\}\\.  See https://tools\\.ietf\\.org/html/rfc7518#section-3\\.2 for more information\\.","errorType":"exception","errorClass":"WeakKeyException","httpStatus":null,"severity":"error","filePath":"api/src/main/java/io/jsonwebtoken/SignatureAlgorithm.java","lineNumber":393,"sourceCode":"                        !HS512.jcaName.equalsIgnoreCase(alg) &&\n                        !HS256.pkcs12Name.equals(alg) &&\n                        !HS384.pkcs12Name.equals(alg) &&\n                        !HS512.pkcs12Name.equals(alg)) {\n                    throw new InvalidKeyException(\"The \" + keyType(signing) + \" key's algorithm '\" + alg +\n                            \"' does not equal a valid HmacSHA* algorithm name and cannot be used with \" + name() + \".\");\n                }\n\n                int size = encoded.length * 8; //size in bits\n                if (size < this.minKeyLength) {\n                    String msg = \"The \" + keyType(signing) + \" key's size is \" + size + \" bits which \" +\n                            \"is not secure enough for the \" + name() + \" algorithm.  The JWT \" +\n                            \"JWA Specification (RFC 7518, Section 3.2) states that keys used with \" + name() + \" MUST have a \" +\n                            \"size >= \" + minKeyLength + \" bits (the key size must be greater than or equal to the hash \" +\n                            \"output size).  Consider using the \" + Keys.class.getName() + \" class's \" +\n                            \"'secretKeyFor(SignatureAlgorithm.\" + name() + \")' method to create a key guaranteed to be \" +\n                            \"secure enough for \" + name() + \".  See \" +\n                            \"https://tools.ietf.org/html/rfc7518#section-3.2 for more information.\";\n                    throw new WeakKeyException(msg);\n                }\n            } finally {\n                if (encoded != null) {\n                    Arrays.fill(encoded, (byte) 0);\n                }\n            }\n\n        } else { //EC or RSA\n\n            if (signing) {\n                if (!(key instanceof PrivateKey)) {\n                    String msg = familyName + \" signing keys must be PrivateKey instances.\";\n                    throw new InvalidKeyException(msg);\n                }\n            }\n\n            if (isEllipticCurve()) {\n","sourceCodeStart":375,"sourceCodeEnd":411,"githubUrl":"https://github.com/jwtk/jjwt/blob/fb71496164c71442d08adec4571d9616ed5e1b8d/api/src/main/java/io/jsonwebtoken/SignatureAlgorithm.java#L375-L411","documentation":"Error \"The ${keyType} key's size is ${size} bits which is not secure enough for the ${name} algorithm.  The JWT JWA Specification (RFC 7518, Section 3.2) states that keys used with ${name} MUST have a size >= ${minKeyLength} bits (the key size must be greater than or equal to the hash output size).  Consider using the ${Keys} class's 'secretKeyFor(SignatureAlgorithm.${name})' method to create a key guaranteed to be secure enough for ${name}.  See https://tools.ietf.org/html/rfc7518#section-3.2 for more information.\" thrown in jwtk/jjwt.","triggerScenarios":"Thrown at api/src/main/java/io/jsonwebtoken/SignatureAlgorithm.java:393 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Generate a sufficiently large HMAC key with Keys.secretKeyFor(SignatureAlgorithm.HS256/HS384/HS512) — 256/384/512 bits respectively.","If using an existing secret, derive or extend it to at least the algorithm's minKeyLength bits (HS256 needs >=256 bits).","Downgrade to a smaller HS* algorithm (e.g. HS256) only if the key length satisfies that algorithm's requirement; never truncate a strong key to fit a weak one."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"fb71496164c71442d08adec4571d9616ed5e1b8d","analyzedAt":"2026-09-09T00:33:09.982Z","contentChangedAt":"2026-09-09T00:33:09.982Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}