jwtk/jjwt · error · SignatureException

The 'none' algorithm cannot be used to create signatures.

Error message

The 'none' algorithm cannot be used to create signatures.

What it means

The 'none' algorithm is a placeholder JWS algorithm that, per RFC 7518, performs no cryptographic operations. The JJWT library deliberately refuses to create signatures with it, throwing SignatureException from digest(), because unsigned JWTs are insecure and the 'none' algorithm is only useful for verification of explicitly unsecured tokens.

Source

Thrown at impl/src/main/java/io/jsonwebtoken/impl/security/NoneSignatureAlgorithm.java:43

import java.security.Key;

final class NoneSignatureAlgorithm implements SecureDigestAlgorithm<Key, Key> {

    private static final String ID = "none";

    static final SecureDigestAlgorithm<Key, Key> INSTANCE = new NoneSignatureAlgorithm();

    private NoneSignatureAlgorithm() {
    }

    @Override
    public String getId() {
        return ID;
    }

    @Override
    public byte[] digest(SecureRequest<InputStream, Key> request) throws SecurityException {
        throw new SignatureException("The 'none' algorithm cannot be used to create signatures.");
    }

    @Override
    public boolean verify(VerifySecureDigestRequest<Key> request) throws SignatureException {
        throw new SignatureException("The 'none' algorithm cannot be used to verify signatures.");
    }

    @Override
    public boolean equals(Object obj) {
        return this == obj ||
                (obj instanceof SecureDigestAlgorithm &&
                        ID.equalsIgnoreCase(((SecureDigestAlgorithm<?, ?>) obj).getId()));
    }

    @Override
    public int hashCode() {
        return getId().hashCode();
    }

View on GitHub (pinned to fb71496164)

Solutions

1. Pick a real signing algorithm such as Jwts.SIG.HS256 with a SecretKey, or RS256/ES256 with a key pair.
2. If an unsecured token is truly needed, construct it manually or use a library that permits 'none' signing, understanding the security implications.
3. Wrap jwt building/signing in try-catch for SignatureException to surface a clearer error to callers.

Example fix

// before
JwtBuilder b = Jwts.builder().subject("me").signWith(Jwts.SIG.none);
// after
JwtBuilder b = Jwts.builder().subject("me")
    .signWith(Jwts.SIG.HS256, secretKey);

if (alg != null && "none".equals(alg.getId())) {
    throw new IllegalArgumentException("Signing with 'none' is not allowed");
}

try {
    String jwt = Jwts.builder().signWith(alg, key)...compact();
} catch (SignatureException e) {
    // alg=none or signing failure: surface config error
}

When it happens

Trigger: Calling Jwls.builder().signWith(Jwts.SIG.none) or otherwise configuring 'alg: none' when trying to SIGN (serialize) a JWS; also calling NoneSignatureAlgorithm.digest() directly.

Common situations: Developers porting from other JWT libraries where 'none' was allowed for signing, or intentionally trying to produce an unsecured JWT (which JJWT does not support for signing).

Understand the failure class

Background: UnsupportedOperationException and "is not supported" errors: when a library deliberately refuses a call — this error's family across 30 libraries.

Related errors

• Invalid ECDSA signature format.
• The 'none' algorithm cannot be used to verify signatures.
• Unsupported signature algorithm '${alg}': ${e.getMessage()}
• Cannot verify JWS signature: unable to locate signature veri
• PrivateKeys may not be used to verify digital signatures. Pr

AI-assisted analysis of jwtk/jjwt@fb71496164 (2026-09-09). Data as JSON: /api/errors/c2fadbd7e50c1279. Report an issue: GitHub.