jwtk/jjwt · error · InvalidKeyException

The ${keyType} key's algorithm cannot be null.

Error message

The ${keyType} key's algorithm cannot be null.

What it means

Validation check in SignatureAlgorithm.assertValid for HMAC algorithms: after obtaining the SecretKey's encoded bytes, the helper reads getAlgorithm() and rejects a null algorithm name. The name is required because the subsequent check verifies it matches a valid HmacSHA* JCA name; a SecretKey created without an algorithm string cannot be validated and throws InvalidKeyException.

Source

Thrown at api/src/main/java/io/jsonwebtoken/SignatureAlgorithm.java:369

        } else if (isHmac()) {

            if (!(key instanceof SecretKey)) {
                String msg = this.familyName + " " + keyType(signing) + " keys must be SecretKey instances.";
                throw new InvalidKeyException(msg);
            }
            SecretKey secretKey = (SecretKey) key;

            byte[] encoded = EMPTY_BYTES;
            try {
                encoded = secretKey.getEncoded();
                if (encoded == null) {
                    throw new InvalidKeyException("The " + keyType(signing) + " key's encoded bytes cannot be null.");
                }

                String alg = secretKey.getAlgorithm();
                if (alg == null) {
                    throw new InvalidKeyException("The " + keyType(signing) + " key's algorithm cannot be null.");
                }

                // These next checks use equalsIgnoreCase per https://github.com/jwtk/jjwt/issues/381#issuecomment-412912272
                if (!HS256.jcaName.equalsIgnoreCase(alg) &&
                        !HS384.jcaName.equalsIgnoreCase(alg) &&
                        !HS512.jcaName.equalsIgnoreCase(alg) &&
                        !HS256.pkcs12Name.equals(alg) &&
                        !HS384.pkcs12Name.equals(alg) &&
                        !HS512.pkcs12Name.equals(alg)) {
                    throw new InvalidKeyException("The " + keyType(signing) + " key's algorithm '" + alg +
                            "' does not equal a valid HmacSHA* algorithm name and cannot be used with " + name() + ".");
                }

                int size = encoded.length * 8; //size in bits
                if (size < this.minKeyLength) {
                    String msg = "The " + keyType(signing) + " key's size is " + size + " bits which " +
                            "is not secure enough for the " + name() + " algorithm.  The JWT " +
                            "JWA Specification (RFC 7518, Section 3.2) states that keys used with " + name() + " MUST have a " +

View on GitHub (pinned to fb71496164)

Solutions

1. Construct the SecretKey with an explicit algorithm, e.g. new SecretKeySpec(bytes, "HmacSHA256").
2. Re-wrap provider-supplied keys with a SecretKeySpec carrying the correct HmacSHA* name before calling signWith/assertValid.
3. Match the algorithm name exactly to the enum's JCA name (HmacSHA256/384/512) or its PKCS12 alias.

When it happens

Trigger: Thrown at api/src/main/java/io/jsonwebtoken/SignatureAlgorithm.java:369 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of jwtk/jjwt@fb71496164 (2026-09-09). Data as JSON: /api/errors/3340f8d2efea4232. Report an issue: GitHub.