liveBook · Manning

StandardPasswordEncoder

As explained in Spring Security in Action, Second Edition

StandardPasswordEncoder is a deprecated Spring Security PasswordEncoder implementation that hashes passwords with SHA-256 and an optional secret.

StandardPasswordEncoder is a Spring Security PasswordEncoder implementation that hashes passwords with SHA-256. It accepts an optional secret for the hashing process, but it is deprecated because this algorithm is no longer considered strong enough for new implementations. section 4.1.3

Use its status to guide implementation decisions:

  • Do not select it for new applications. section 4.1.3
  • Replace it when discovered in an existing application with a more powerful password encoder. section 4.1.3
  • Compare alternatives such as Pbkdf2PasswordEncoder, BCryptPasswordEncoder, and SCryptPasswordEncoder. section 4.1.3
PasswordEncoder p = new StandardPasswordEncoder();
PasswordEncoder p = new StandardPasswordEncoder("secret");

The constructors show the default form and the form that supplies an optional secret. section 4.1.3

How Spring Security in Action, Second Edition covers it

How deep it goes
Defines SHA-256 hashing, optional secrets, deprecation, and constructor usage without explaining hashing internals.
Examples
Shows Java construction with and without a secret and lists PBKDF2, bcrypt, and scrypt alternatives.
What you can do after
Evaluate existing usage and choose a stronger replacement for new password-encoding implementations.
How it connects
Contrasts StandardPasswordEncoder with PasswordEncoder, PBKDF2, bcrypt, and scrypt implementations.
Cover of Spring Security in Action, Second Edition
liveBookmanning.com
Read Spring Security in Action, Second Edition on liveBook Get the book at manning.com

Related concepts

This explainer was generated by Manning's knowledge graph from the text of Spring Security in Action, Second Edition. The section links point to the parts of the book it draws on.