{"record":{"id":"f9e67ce0bbd08cc8","repo":"jwtk/jjwt","slug":"the-specified-rsa-signing-key-is-not-strong-enough","errorCode":null,"errorMessage":"The specified RSA signing key is not strong enough to be used with JWT RSA signature algorithms.  The JWT specification requires RSA keys to be >= 2048 bits long.  The specified RSA key is ${bitLength} bits.  See https://tools.ietf.org/html/rfc7518#section-3.3 for more information.","messagePattern":"The specified RSA signing key is not strong enough to be used with JWT RSA signature algorithms\\.  The JWT specification requires RSA keys to be >= 2048 bits long\\.  The specified RSA key is (.+?) bits\\.  See https://tools\\.ietf\\.org/html/rfc7518#section-3\\.3 for more information\\.","errorType":"exception","errorClass":"WeakKeyException","httpStatus":null,"severity":"error","filePath":"api/src/main/java/io/jsonwebtoken/SignatureAlgorithm.java","lineNumber":630,"sourceCode":"            RSAKey rsaKey = (RSAKey) key;\n            int bitLength = rsaKey.getModulus().bitLength();\n\n            if (bitLength >= 4096) {\n                RS512.assertValidSigningKey(key);\n                return RS512;\n            } else if (bitLength >= 3072) {\n                RS384.assertValidSigningKey(key);\n                return RS384;\n            } else if (bitLength >= RS256.minKeyLength) {\n                RS256.assertValidSigningKey(key);\n                return RS256;\n            }\n\n            String msg = \"The specified RSA signing key is not strong enough to be used with JWT RSA signature \" +\n                    \"algorithms.  The JWT specification requires RSA keys to be >= 2048 bits long.  The specified RSA \" +\n                    \"key is \" + bitLength + \" bits.  See https://tools.ietf.org/html/rfc7518#section-3.3 for more \" +\n                    \"information.\";\n            throw new WeakKeyException(msg);\n        }\n\n        // if we've made it this far in the method, the key is an ECKey due to the instanceof assertions at the\n        // top of the method\n\n        ECKey ecKey = (ECKey) key;\n        int bitLength = ecKey.getParams().getOrder().bitLength();\n\n        for (SignatureAlgorithm alg : PREFERRED_EC_ALGS) {\n            if (bitLength >= alg.minKeyLength) {\n                alg.assertValidSigningKey(key);\n                return alg;\n            }\n        }\n\n        String msg = \"The specified Elliptic Curve signing key is not strong enough to be used with JWT ECDSA \" +\n                \"signature algorithms.  The JWT specification requires ECDSA keys to be >= 256 bits long.  \" +\n                \"The specified ECDSA key is \" + bitLength + \" bits.  See \" +","sourceCodeStart":612,"sourceCodeEnd":648,"githubUrl":"https://github.com/jwtk/jjwt/blob/fb71496164c71442d08adec4571d9616ed5e1b8d/api/src/main/java/io/jsonwebtoken/SignatureAlgorithm.java#L612-L648","documentation":"Error \"The specified RSA signing key is not strong enough to be used with JWT RSA signature algorithms.  The JWT specification requires RSA keys to be >= 2048 bits long.  The specified RSA key is ${bitLength} bits.  See https://tools.ietf.org/html/rfc7518#section-3.3 for more information.\" thrown in jwtk/jjwt.","triggerScenarios":"Thrown at api/src/main/java/io/jsonwebtoken/SignatureAlgorithm.java:630 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Generate an RSA key pair with modulus >=2048 bits (4096 for RS512) via Keys.keyPairFor(SignatureAlgorithm.RS256).","Replace 1024-bit legacy RSA keys; re-issue affected tokens after rotating keys.","If a smaller RSA key must be retained for another purpose, do not use it for JWT signing — provision a compliant key."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"fb71496164c71442d08adec4571d9616ed5e1b8d","analyzedAt":"2026-09-09T00:33:09.982Z","contentChangedAt":"2026-09-09T00:33:09.982Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}