jwtk/jjwt · error · InvalidKeyException

The 'NONE' signature algorithm does not support cryptographi

Error message

The 'NONE' signature algorithm does not support cryptographic keys.

What it means

Generic sentinel guard in SignatureAlgorithm.assertValid: it fires whenever a caller passes a Key to NONE, the unsigned/no-signature algorithm. NONE performs no JCA signature, so any cryptographic key (SecretKey, PrivateKey, PublicKey) is invalid for it; the helper rejects the input before any key-type or size checks run.

Source

Thrown at api/src/main/java/io/jsonwebtoken/SignatureAlgorithm.java:350

        assertValid(key, false);
    }

    /**
     * @since 0.10.0 to support assertValid(Key, boolean)
     */
    private static String keyType(boolean signing) {
        return signing ? "signing" : "verification";
    }

    /**
     * @since 0.10.0
     */
    private void assertValid(Key key, boolean signing) throws InvalidKeyException {

        if (this == NONE) {

            String msg = "The 'NONE' signature algorithm does not support cryptographic keys.";
            throw new InvalidKeyException(msg);

        } else if (isHmac()) {

            if (!(key instanceof SecretKey)) {
                String msg = this.familyName + " " + keyType(signing) + " keys must be SecretKey instances.";
                throw new InvalidKeyException(msg);
            }
            SecretKey secretKey = (SecretKey) key;

            byte[] encoded = EMPTY_BYTES;
            try {
                encoded = secretKey.getEncoded();
                if (encoded == null) {
                    throw new InvalidKeyException("The " + keyType(signing) + " key's encoded bytes cannot be null.");
                }

                String alg = secretKey.getAlgorithm();
                if (alg == null) {

View on GitHub (pinned to fb71496164)

Solutions

1. Do not pass a key at all when using SignatureAlgorithm.NONE; build the JWT unsigned with .signWith.NONE or compact it without a signature as the JWS 'alg':'none' use case requires.
2. If a signature is intended, select the correct algorithm (e.g. HS256, RS256) matching the key type instead of NONE.
3. Wrap key configuration in validation so NONE is never combined with a Key argument.

When it happens

Trigger: Thrown at api/src/main/java/io/jsonwebtoken/SignatureAlgorithm.java:350 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of jwtk/jjwt@fb71496164 (2026-09-09). Data as JSON: /api/errors/9a1effc38cae84cd. Report an issue: GitHub.