Loading published curriculum…

16 · Spring Security in depth / LESSON 76 OF 102

Password hashing and credential storage

Store a one-way adaptive password hash rather than plaintext or reversible encryption.

Before this lesson: FilterChainProxy, authentication, and authorization

Understand the topic

PasswordEncoder.matches verifies a candidate against its encoded representation. A salt prevents identical passwords from having identical stored encodings. Choose a supported adaptive encoder and tune cost against measured login capacity without removing rate limits.

DelegatingPasswordEncoder records an algorithm identifier so stored encodings can evolve. Never compare a freshly encoded string with the stored string: random salts make that unreliable. Do not log passwords, request bodies containing them, or password-reset tokens.

EXAMPLE · JAVA

PasswordConfig.java

import org.springframework.context.annotation.*;
import org.springframework.security.crypto.factory.PasswordEncoderFactories;
import org.springframework.security.crypto.password.PasswordEncoder;
@Configuration
public class PasswordConfig {
 @Bean PasswordEncoder passwordEncoder() {
  return PasswordEncoderFactories.createDelegatingPasswordEncoder();
 }
}

What to expect

Inject the encoder into registration and credential verification. encode stores a hash; matches verifies a candidate without recovering the password.

YOUR TURN

Put it into practice

  1. 01Encode the same sample password twice and compare outputs.
  2. 02Verify correct and incorrect candidates with matches and benchmark cost locally.
  3. 03Verify: Plaintext never enters storage or logs and verification works despite different salted encodings.

Pass a quiz or complete a lab to check today’s streak. Each lesson counts once per day, including when you review it later.

UNDER THE HOOD

Build the mental model

Store a one-way adaptive password hash rather than plaintext or reversible encryption.

  1. 01PasswordEncoder.matches verifies a candidate against its encoded representation. A salt prevents identical passwords from having identical stored encodings. Choose a supported adaptive encoder and tune cost against measured login capacity without removing rate limits.
  2. 02DelegatingPasswordEncoder records an algorithm identifier so stored encodings can evolve. Never compare a freshly encoded string with the stored string: random salts make that unreliable. Do not log passwords, request bodies containing them, or password-reset tokens.
  3. 03Trace the example: Inject the encoder into registration and credential verification. encode stores a hash; matches verifies a candidate without recovering the password.

A mistake worth avoiding

Correct passwords fail after comparing two encoded strings directly.

DEBUGGING ROOM

Something broke. Where do you look?

Correct passwords fail after comparing two encoded strings directly.

Before revealing the diagnosis, write down your first investigation step.

CHECK YOUR UNDERSTANDING

Should two salted encodings of the same password always be identical?

Choose one answer

BUILD IT YOURSELF

Encode the same sample password twice and compare outputs.

  1. 1.Encode the same sample password twice and compare outputs.
  2. 2.Verify correct and incorrect candidates with matches and benchmark cost locally.
  3. 3.Reproduce this failure, then repair it: Correct passwords fail after comparing two encoded strings directly.

Acceptance checklist

Lab completion is your self-report. Knowledge checks do not certify project quality.

RETRIEVE IT FROM MEMORY

Should two salted encodings of the same password always be identical?

Revisit this lesson in three days after a successful check or lab.

Ready for the next step?

Plaintext never enters storage or logs and verification works despite different salted encodings.

Reading is separate from passing a knowledge check or completing a lab.

Go deeper · official references