PasswordEncoder is a Spring Security strategy that encodes passwords and checks whether supplied passwords match stored representations. AuthenticationProvider uses it during authentication, and Basic authentication requires one. section 2.2 section 4.1
The contract centers on three operations:
- encode(CharSequence rawPassword) transforms a supplied password into its stored representation, typically through encryption or hashing. section 4.1.1
- matches(CharSequence rawPassword, String encodedPassword) validates a supplied password against a known representation. section 4.1.1
- upgradeEncoding(String encodedPassword) defaults to false and can signal that an existing representation should be encoded again. section 4.1.1
- Keep encode and matches consistent: every result from encode should be verifiable by matches on the same implementation. section 4.1.2
Spring Security can use a PasswordEncoder bean alongside UserDetailsService. Defining users without an encoder can produce “There is no PasswordEncoder mapped for the id \"null\"”; an explicit NoOpPasswordEncoder makes the sample work but stores cleartext and is unsuitable for production. section 2.3.1 section 2.4
Registering an encoder bean
A configuration class can expose PasswordEncoder as a bean, while UserDetailsService manages an in-memory user. The encoder may also be registered locally through SecurityFilterChain when no other component needs injection. section 2.3.1 section 2.3.3
Figure 4.1 The Spring Security authentication process. The AuthenticationProvider uses the PasswordEncoder to validate the user’s password in the authentication process.
Use the authentication-process figure to trace how AuthenticationProvider invokes PasswordEncoder to validate a user password. section 4.1
Available implementations include PBKDF2, BCrypt, and SCrypt. NoOpPasswordEncoder leaves passwords cleartext, while StandardPasswordEncoder uses deprecated SHA-256. DelegatingPasswordEncoder selects an implementation from a prefix such as {bcrypt}, allowing algorithms to coexist during migrations. section 4.1.3 section 4.1.4
