SecretKeyFactory (Java Platform SE 8 )
Keywords: javax.crypto.SecretKeyFactory class
Date: 2026-06-25

compact1, compact2, compact3
javax.crypto

## Class SecretKeyFactory

- java.lang.Object
- - javax.crypto.SecretKeyFactory

-     public class SecretKeyFactory
      extends Object

  This class represents a factory for secret keys.

  Key factories are used to convert keys (opaque cryptographic keys of type `Key`) into key specifications (transparent representations of the underlying key material), and vice versa. Secret key factories operate only on secret (symmetric) keys.

  Key factories are bi-directional, i.e., they allow to build an opaque key object from a given key specification (key material), or to retrieve the underlying key material of a key object in a suitable format.

  Application developers should refer to their provider's documentation to find out which key specifications are supported by the `generateSecret` and `getKeySpec` methods. For example, the DES secret-key factory supplied by the "SunJCE" provider supports `DESKeySpec` as a transparent representation of DES keys, and that provider's secret-key factory for Triple DES keys supports `DESedeKeySpec` as a transparent representation of Triple DES keys.

  Every implementation of the Java platform is required to support the following standard `SecretKeyFactory` algorithms:

  - `DES`
  - `DESede`
  These algorithms are described in the SecretKeyFactory section of the Java Cryptography Architecture Standard Algorithm Name Documentation. Consult the release documentation for your implementation to see if any other algorithms are supported.
  Since:
    1.4
  See Also:
    `SecretKey`, `DESKeySpec`, `DESedeKeySpec`, `PBEKeySpec`

- - ### Constructor Summary

    Constructors
    Modifier | Constructor and Description
    --- | ---
    `protected` | `SecretKeyFactory(SecretKeyFactorySpi keyFacSpi, Provider provider, String algorithm)` Creates a SecretKeyFactory object.

  - ### Method Summary

    All Methods Static Methods Instance Methods Concrete Methods
    Modifier and Type | Method and Description
    --- | ---
    `SecretKey` | `generateSecret(KeySpec keySpec)` Generates a `SecretKey` object from the provided key specification (key material).
    `String` | `getAlgorithm()` Returns the algorithm name of this `SecretKeyFactory` object.
    `static SecretKeyFactory` | `getInstance(String algorithm)` Returns a `SecretKeyFactory` object that converts secret keys of the specified algorithm.
    `static SecretKeyFactory` | `getInstance(String algorithm, Provider provider)` Returns a `SecretKeyFactory` object that converts secret keys of the specified algorithm.
    `static SecretKeyFactory` | `getInstance(String algorithm, String provider)` Returns a `SecretKeyFactory` object that converts secret keys of the specified algorithm.
    `KeySpec` | `getKeySpec(SecretKey key, Class<?> keySpec)` Returns a specification (key material) of the given key object in the requested format.
    `Provider` | `getProvider()` Returns the provider of this `SecretKeyFactory` object.
    `SecretKey` | `translateKey(SecretKey key)` Translates a key object, whose provider may be unknown or potentially untrusted, into a corresponding key object of this secret-key factory.

    - ### Methods inherited from class java.lang.Object

      `clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait`

- - ### Constructor Detail

    - #### SecretKeyFactory

          protected SecretKeyFactory(SecretKeyFactorySpi keyFacSpi,
                                     Provider provider,
                                     String algorithm)

      Creates a SecretKeyFactory object.
      Parameters:
        `keyFacSpi` - the delegate
        `provider` - the provider
        `algorithm` - the secret-key algorithm

  - ### Method Detail

    - #### getInstance

          public static final SecretKeyFactory getInstance(String algorithm)
                                                    throws NoSuchAlgorithmException

      Returns a `SecretKeyFactory` object that converts secret keys of the specified algorithm.

      This method traverses the list of registered security Providers, starting with the most preferred Provider. A new SecretKeyFactory object encapsulating the SecretKeyFactorySpi implementation from the first Provider that supports the specified algorithm is returned.

      Note that the list of registered providers may be retrieved via the `Security.getProviders()` method.

      Parameters:
        `algorithm` - the standard name of the requested secret-key algorithm. See the SecretKeyFactory section in the Java Cryptography Architecture Standard Algorithm Name Documentation for information about standard algorithm names.
      Returns:
        the new `SecretKeyFactory` object.
      Throws:
        `NullPointerException` - if the specified algorithm is null.
        `NoSuchAlgorithmException` - if no Provider supports a SecretKeyFactorySpi implementation for the specified algorithm.
      See Also:
        `Provider`

    - #### getInstance

          public static final SecretKeyFactory getInstance(String algorithm,
                                                           String provider)
                                                    throws NoSuchAlgorithmException,
                                                           NoSuchProviderException

      Returns a `SecretKeyFactory` object that converts secret keys of the specified algorithm.

      A new SecretKeyFactory object encapsulating the SecretKeyFactorySpi implementation from the specified provider is returned. The specified provider must be registered in the security provider list.

      Note that the list of registered providers may be retrieved via the `Security.getProviders()` method.

      Parameters:
        `algorithm` - the standard name of the requested secret-key algorithm. See the SecretKeyFactory section in the Java Cryptography Architecture Standard Algorithm Name Documentation for information about standard algorithm names.
        `provider` - the name of the provider.
      Returns:
        the new `SecretKeyFactory` object.
      Throws:
        `NoSuchAlgorithmException` - if a SecretKeyFactorySpi implementation for the specified algorithm is not available from the specified provider.
        `NullPointerException` - if the specified algorithm is null.
        `NoSuchProviderException` - if the specified provider is not registered in the security provider list.
        `IllegalArgumentException` - if the `provider` is null or empty.
      See Also:
        `Provider`

    - #### getInstance

          public static final SecretKeyFactory getInstance(String algorithm,
                                                           Provider provider)
                                                    throws NoSuchAlgorithmException

      Returns a `SecretKeyFactory` object that converts secret keys of the specified algorithm.

      A new SecretKeyFactory object encapsulating the SecretKeyFactorySpi implementation from the specified Provider object is returned. Note that the specified Provider object does not have to be registered in the provider list.

      Parameters:
        `algorithm` - the standard name of the requested secret-key algorithm. See the SecretKeyFactory section in the Java Cryptography Architecture Standard Algorithm Name Documentation for information about standard algorithm names.
        `provider` - the provider.
      Returns:
        the new `SecretKeyFactory` object.
      Throws:
        `NullPointerException` - if the specified algorithm is null.
        `NoSuchAlgorithmException` - if a SecretKeyFactorySpi implementation for the specified algorithm is not available from the specified Provider object.
        `IllegalArgumentException` - if the `provider` is null.
      See Also:
        `Provider`

    - #### getProvider

          public final Provider getProvider()

      Returns the provider of this `SecretKeyFactory` object.
      Returns:
        the provider of this `SecretKeyFactory` object

    - #### getAlgorithm

          public final String getAlgorithm()

      Returns the algorithm name of this `SecretKeyFactory` object.

      This is the same name that was specified in one of the `getInstance` calls that created this `SecretKeyFactory` object.

      Returns:
        the algorithm name of this `SecretKeyFactory` object.

    - #### generateSecret

          public final SecretKey generateSecret(KeySpec keySpec)
                                         throws InvalidKeySpecException

      Generates a `SecretKey` object from the provided key specification (key material).
      Parameters:
        `keySpec` - the specification (key material) of the secret key
      Returns:
        the secret key
      Throws:
        `InvalidKeySpecException` - if the given key specification is inappropriate for this secret-key factory to produce a secret key.

    - #### getKeySpec

          public final KeySpec getKeySpec(SecretKey key,
                                          Class<?> keySpec)
                                   throws InvalidKeySpecException

      Returns a specification (key material) of the given key object in the requested format.
      Parameters:
        `key` - the key
        `keySpec` - the requested format in which the key material shall be returned
      Returns:
        the underlying key specification (key material) in the requested format
      Throws:
        `InvalidKeySpecException` - if the requested key specification is inappropriate for the given key (e.g., the algorithms associated with `key` and `keySpec` do not match, or `key` references a key on a cryptographic hardware device whereas `keySpec` is the specification of a software-based key), or the given key cannot be dealt with (e.g., the given key has an algorithm or format not supported by this secret-key factory).

    - #### translateKey

          public final SecretKey translateKey(SecretKey key)
                                       throws InvalidKeyException

      Translates a key object, whose provider may be unknown or potentially untrusted, into a corresponding key object of this secret-key factory.
      Parameters:
        `key` - the key whose provider is unknown or untrusted
      Returns:
        the translated key
      Throws:
        `InvalidKeyException` - if the given key cannot be processed by this secret-key factory.

Submit a bug or feature
For further API reference and developer documentation, see Java SE Documentation. That documentation contains more detailed, developer-targeted descriptions, with conceptual overviews, definitions of terms, workarounds, and working code examples.
Copyright © 1993, 2026, Oracle and/or its affiliates. All rights reserved. Use is subject to license terms. Also see the documentation redistribution policy.