Password encoding with BCrypt in Spring Boot - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

What is the output of this BCrypt password encoding snippet?

Consider the following Spring Boot code that encodes a password using BCryptPasswordEncoder. What will be the output type and general format of the encoded password string?

Spring Boot

import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;

public class PasswordEncoderTest {
    public static void main(String[] args) {
        BCryptPasswordEncoder encoder = new BCryptPasswordEncoder();
        String rawPassword = "mypassword";
        String encodedPassword = encoder.encode(rawPassword);
        System.out.println(encodedPassword);
    }
}

A A string starting with "$2a$" or "$2b$" followed by a 60-character hash

B A plain text password identical to the input string

C A numeric hash value representing the password

D A Base64 encoded string without any prefix

💡 Hint

Think about how BCrypt hashes are formatted and what the encoder outputs.

BCryptPasswordEncoder outputs a hashed password string that starts with a version prefix like "$2a$" or "$2b$" and is always 60 characters long. It is not plain text or numeric.

❓ state_output

intermediate

What is the result of matching a raw password against a BCrypt hash?

Given this code snippet, what will be the output of the match check?

Spring Boot

import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;

public class PasswordMatchTest {
    public static void main(String[] args) {
        BCryptPasswordEncoder encoder = new BCryptPasswordEncoder();
        String rawPassword = "secret123";
        String encodedPassword = encoder.encode(rawPassword);
        boolean matches = encoder.matches("secret123", encodedPassword);
        System.out.println(matches);
    }
}

A Runtime exception due to invalid password format

B true

C Compilation error due to missing imports

D false

💡 Hint

The matches method compares raw and encoded passwords correctly if used properly.

The matches method returns true if the raw password matches the encoded hash. Since the same raw password is checked, it returns true.

📝 Syntax

advanced

Which option correctly configures a BCryptPasswordEncoder bean in Spring Boot?

You want to create a BCryptPasswordEncoder bean in a Spring Boot configuration class. Which code snippet is syntactically correct and follows Spring Boot patterns?

A

@Bean
public void passwordEncoder() {
    new BCryptPasswordEncoder();
}

B

public BCryptPasswordEncoder passwordEncoder() {
    return new BCryptPasswordEncoder();
}

C

@Bean
public BCryptPasswordEncoder passwordEncoder() {
    BCryptPasswordEncoder encoder;
}

D

@Bean
public BCryptPasswordEncoder passwordEncoder() {
    return new BCryptPasswordEncoder();
}

💡 Hint

Remember that a bean method must return the bean instance and be annotated with @Bean.

Option D correctly defines a method annotated with @Bean that returns a new BCryptPasswordEncoder instance. Other options either miss @Bean, return type, or return statement.

🔧 Debug

advanced

Why does this password match check always return false?

Examine the code below. Why does the password match check always print false?

Spring Boot

import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;

public class PasswordCheck {
    public static void main(String[] args) {
        BCryptPasswordEncoder encoder = new BCryptPasswordEncoder();
        String rawPassword = "pass123";
        String encodedPassword = encoder.encode(rawPassword);
        boolean matches = encoder.matches(rawPassword, rawPassword);
        System.out.println(matches);
    }
}

A Because matches compares the raw password to the encoded password, but here it compares raw to raw

B Because rawPassword is null causing NullPointerException

C Because encode method returns null causing matches to fail

D Because BCryptPasswordEncoder is not initialized properly

💡 Hint

Check the arguments passed to the matches method carefully.

The matches method expects the first argument as raw password and the second as encoded password. Here both are raw, so it returns false.

🧠 Conceptual

expert

What is the main security benefit of using BCrypt for password encoding?

Why is BCrypt preferred over simple hashing algorithms like MD5 or SHA-1 for password encoding in Spring Boot applications?

A BCrypt hashes can be reversed to get the original password if needed

B BCrypt produces shorter hashes which save database space

C BCrypt automatically salts passwords and is computationally expensive, making brute-force attacks harder

D BCrypt uses symmetric encryption to protect passwords

💡 Hint

Think about how password hashing defends against attackers guessing passwords.

BCrypt adds a salt and is slow to compute, which makes it much harder for attackers to use brute-force or rainbow table attacks compared to fast hashes like MD5.