jwtk/jjwt · error · SignatureException

The 'none' algorithm cannot be used to verify signatures.

Error message

The 'none' algorithm cannot be used to verify signatures.

What it means

The 'none' (unsecured) JWS algorithm rejects all verification attempts in JJWT. verify() always throws SignatureException because accepting 'alg: none' tokens is a classic JWT vulnerability; verification with no signature cannot establish authenticity.

Source

Thrown at impl/src/main/java/io/jsonwebtoken/impl/security/NoneSignatureAlgorithm.java:48

    static final SecureDigestAlgorithm<Key, Key> INSTANCE = new NoneSignatureAlgorithm();

    private NoneSignatureAlgorithm() {
    }

    @Override
    public String getId() {
        return ID;
    }

    @Override
    public byte[] digest(SecureRequest<InputStream, Key> request) throws SecurityException {
        throw new SignatureException("The 'none' algorithm cannot be used to create signatures.");
    }

    @Override
    public boolean verify(VerifySecureDigestRequest<Key> request) throws SignatureException {
        throw new SignatureException("The 'none' algorithm cannot be used to verify signatures.");
    }

    @Override
    public boolean equals(Object obj) {
        return this == obj ||
                (obj instanceof SecureDigestAlgorithm &&
                        ID.equalsIgnoreCase(((SecureDigestAlgorithm<?, ?>) obj).getId()));
    }

    @Override
    public int hashCode() {
        return getId().hashCode();
    }

    @Override
    public String toString() {
        return ID;
    }

View on GitHub (pinned to fb71496164)

Solutions

Re-issue the tokens with a real algorithm (e.g. HS256) and verify with the corresponding key.
If unsigned tokens must be consumed, parse the payload manually rather than using JJWT's verified parser.
Never configure a parser to accept 'none' for production tokens.

Example fix

// before
Jws<Claims> jws = Jwts.parser().verifyWith(Jwts.SIG.none).build().parseSignedClaims(token);
// after
Jws<Claims> jws = Jwts.parser().verifyWith(secretKey).build().parseSignedClaims(token);

Defensive patterns

Strategy: try-catch

Validate before calling

if (headerAlg != null && "none".equals(headerAlg)) {
    throw new SecurityException("Rejecting unsecured token (alg=none)");
}

Try / catch

try {
    Jws<Claims> jws = Jwts.parser().verifyWith(key).build().parseSignedClaims(token);
} catch (SignatureException e) {
    // includes alg=none verification refusal
    throw new AuthenticationException("Invalid token signature", e);
}

Prevention

Never accept alg=none tokens in production
Always pin the expected algorithm in the parser
Migrate legacy unsigned tokens to signed ones

When it happens

Trigger: Calling Jwts.parser().verifyWith(Jwts.SIG.none) or verifying a token whose header declares alg=none via an algorithm configured as NoneSignatureAlgorithm.

Common situations: Trying to parse unsigned tokens produced by another system; security testing of alg=none attacks; migrating legacy tokens that were created without a signature.

Understand the failure class

Background: UnsupportedOperationException and "is not supported" errors: when a library deliberately refuses a call — this error's family across 30 libraries.

Related errors

AI-assisted analysis of jwtk/jjwt@fb71496164 (2026-09-09). Data as JSON: /api/errors/7f2fbd0d8a7ed801. Report an issue: GitHub.