spring-projects/spring-security · error · IllegalArgumentException

keyLength must be greater than 0

Error message

keyLength must be greater than 0

What it means

The Base64StringKeyGenerator(Base64.Encoder, int) constructor requires a strictly positive keyLength (in bytes for the underlying secure-random generator) and throws IllegalArgumentException('keyLength must be greater than 0') when keyLength <= 0. Zero or negative key lengths cannot produce a usable random key.

Source

Thrown at crypto/src/main/java/org/springframework/security/crypto/keygen/Base64StringKeyGenerator.java:72

	/**
	 * Creates an instance with keyLength of 32 bytes and the provided encoder.
	 * @param encoder the encoder to use
	 */
	public Base64StringKeyGenerator(Base64.Encoder encoder) {
		this(encoder, DEFAULT_KEY_LENGTH);
	}

	/**
	 * Creates an instance with the provided key length and encoder.
	 * @param encoder the encoder to use
	 * @param keyLength the key length to use
	 */
	public Base64StringKeyGenerator(Base64.Encoder encoder, int keyLength) {
		if (encoder == null) {
			throw new IllegalArgumentException("encode cannot be null");
		}
		if (keyLength <= 0) {
			throw new IllegalArgumentException("keyLength must be greater than 0");
		}
		this.encoder = encoder;
		this.keyGenerator = KeyGenerators.secureRandom(keyLength);
	}

	@Override
	public String generateKey() {
		byte[] key = this.keyGenerator.generateKey();
		byte[] base64EncodedKey = this.encoder.encode(key);
		return new String(base64EncodedKey);
	}

}

View on GitHub (pinned to 96852e8860)

Solutions

1. Pass a positive byte length (e.g. 32 for a 256-bit key).
2. If the value comes from configuration, validate keyLength > 0 before constructing the generator.
3. Remember this constructor takes bytes, not bits — convert bits/8 and guard against truncation to 0.

Example fix

// before
int keyLength = config.getKeyBits() / 8 / 8; // 256 bits -> 0
Base64StringKeyGenerator gen = new Base64StringKeyGenerator(Base64.getEncoder(), keyLength);
// after
int keyLength = config.getKeyBits() / 8; // 256 bits -> 32 bytes
if (keyLength <= 0) throw new IllegalArgumentException("keyBits must be positive");
Base64StringKeyGenerator gen = new Base64StringKeyGenerator(Base64.getEncoder(), keyLength);

if (keyLength <= 0) {
    throw new IllegalArgumentException("keyLength must be a positive number of bytes");
}
Base64StringKeyGenerator gen = new Base64StringKeyGenerator(Base64.getEncoder(), keyLength);

boolean isValidKeyLength(int keyLength) { return keyLength > 0; }

try {
    generator = new Base64StringKeyGenerator(encoder, keyLength);
} catch (IllegalArgumentException ex) {
    throw new ConfigurationException("keyLength must be > 0 (bytes); got " + keyLength, ex);
}

When it happens

Trigger: Calling new Base64StringKeyGenerator(encoder, 0) or a negative length; passing a length computed from config/math that evaluated to 0 (e.g. bits/bytes conversion error or an empty property defaulting to 0).

Common situations: Config property 'keyLength' missing and binding to 0; passing a bit count (e.g. 256) after already dividing by 8 twice; copy-paste from a generator that takes bit length instead of byte length.

Related errors

• encode cannot be null
• Cpu cost parameter must be > 1 and < 65536.
• Memory cost must be >= 1.
• Cannot pass null or empty values to constructor
• idForEncode cannot be null

AI-assisted analysis of spring-projects/spring-security@96852e8860 (2026-09-10). Data as JSON: /api/errors/49531c50f6faaf30. Report an issue: GitHub.