Security Top

I just announced the new Learn Spring Security course, including the full material focused on the new OAuth2 stack in Spring Security 5:


1. Overview

This article discusses a critical part of the registration process – password encoding – basically not storing the password in plaintext.

There are a few encoding mechanisms supported by Spring Security – and for the article, we'll use BCrypt, as it's usually the best solution available.

Most of the other mechanisms, such as the MD5PasswordEncoder and ShaPasswordEncoder use weaker algorithms and are now deprecated.

Further reading:

New Password Storage In Spring Security 5

A quick guide to understanding password encryption in Spring Security 5 and migrating to better encryption algorithms.

Allow Authentication from Accepted Locations Only with Spring Security

Learn how to only allow users to authenticate from accepted locations only with Spring Security.

Spring Security – Auto Login User After Registration

Learn how to quickly auto-authenticate a user after they complete the registration process.

2. Define the Password Encoder

We'll start by defining the simple BCryptPasswordEncoder as a bean in our configuration:

public PasswordEncoder encoder() {
    return new BCryptPasswordEncoder();

Older implementations – such as SHAPasswordEncoder – would require the client to pass in a salt value when encoding the password.

BCrypt, however, will internally generate a random salt instead. This is important to understand because it means that each call will have a different result, and so we need to only encode the password once.

To make this random salt generation work, BCrypt will store the salt inside the hash value itself. For instance, in the following hash value:


There are three fields separated by $:

  1. The “2a” represents the BCrypt algorithm version
  2. The “10” represents the strength of the algorithm
  3. The “ZLhnHxdpHETcxmtEStgpI.” part is actually the randomly generated salt. Basically, the first 22 characters are salt. The remaining part of the last field is the actual hashed version of the plain text

Also, be aware that the BCrypt algorithm generates a String of length 60, so we need to make sure that the password will be stored in a column that can accommodate it. A common mistake is to create a column of a different length and then get an Invalid Username or Password error at authentication time.

3. Encode the Password on Registration

We will now use the PasswordEncoder in our UserService to hash the password during the user registration process:

Example 3.1. – The UserService Hashes the Password

private PasswordEncoder passwordEncoder;

public User registerNewUserAccount(UserDto accountDto) throws EmailExistsException {
    if (emailExist(accountDto.getEmail())) {
        throw new EmailExistsException(
          "There is an account with that email adress:" + accountDto.getEmail());
    User user = new User();
    user.setRole(new Role(Integer.valueOf(1), user));

4. Encode the Password on Authentication

Let's now handle the other half of this process and encode the password when the user authenticates.

First, we need to inject the password encoder bean we defined earlier into our authentication provider:

private UserDetailsService userDetailsService;

public DaoAuthenticationProvider authProvider() {
    DaoAuthenticationProvider authProvider = new DaoAuthenticationProvider();
    return authProvider;

The security configuration is simple:

  • we are injecting our implementation of the users details service
  • we are defining an authentication provider that references our details service
  • we are also enabling the password encoder

And finally, we need to reference this auth provider in our security XML configuration:

    <authentication-provider ref="authProvider" />

Or, in case you're using Java configuration:

@ComponentScan(basePackages = { "" })
public class SecSecurityConfig extends WebSecurityConfigurerAdapter {

    protected void configure(AuthenticationManagerBuilder auth) throws Exception {

5. Conclusion

This quick tutorial continues the Registration series by showing how to properly store the password in the database by leveraging the simple but very powerful BCrypt implementation.

The full implementation of this Registration with Spring Security tutorial can be found over on GitHub.

Next »
The Registration API becomes RESTful
« Previous
Spring Security Registration – Resend Verification Email
Security bottom

I just announced the new Learn Spring Security course, including the full material focused on the new OAuth2 stack in Spring Security 5:

Inline Feedbacks
View all comments
5 years ago

Thanks for your article. One question: if salt is random when encoding is called , how can BCrypt check if password sumitted by user matches with the store one ?

Eugen Paraschiv
5 years ago
Reply to  jmzc

That’s a great question. BCrypt generates the salt internally, and then stores it concatenated with the cost and the cipher, in a single field, delimited by $. It then uses it on authentication. Hope that helps. Cheers,

5 years ago

I still get a Invalid Username or Password error even though the password column is 255 long, and I get a warning on the console from BCrypt saying : “Encoded password does not look like BCrypt”. Any help would be deeply appreciated.

Eugen Paraschiv
5 years ago
Reply to  bzagh

Is that using the project on github? If so – please open up a bug/issue there with a bit more detail and I’ll take a look. Cheers,

5 years ago

what if I am using Java for configuration of the security? how can I refer the auth to it not via XML file?

Eugen Paraschiv
5 years ago
Reply to  אודליה

I’ll add a Java section to the article – thanks for the suggestion. Cheers,

4 years ago

Eugene, thanks for doing this. Just a quick note: I was not able to find in the source code the “encoder()” method mentioned in step 4, but if you simply replace it for the “Autowired” “passwordEncoder” object that you’ll have to declare somewhere, it does the trick. Hope that helps someone out there. Again thanks.

Comments are closed on this article!