Password encoding with BCrypt in Spring Boot - Mini Project: Build & Apply

Password encoding with BCrypt

📖 Scenario: You are building a simple Spring Boot application that needs to securely store user passwords. To protect user passwords, you will use the BCrypt password encoder, which hashes passwords so they are safe to save.

🎯 Goal: Build a Spring Boot component that encodes a plain text password using BCrypt and verifies the encoded password.

📋 What You'll Learn

Create a PasswordEncoder bean using BCryptPasswordEncoder

Encode a plain text password using the encode method

Verify the encoded password matches the original using the matches method

Use Spring Boot annotations and configuration patterns

💡 Why This Matters

🌍 Real World

Password encoding is essential to protect user credentials in web applications. BCrypt is a strong hashing algorithm that makes stored passwords secure against theft.

💼 Career

Understanding password encoding with BCrypt is a key skill for backend developers working on authentication and security in Java Spring Boot applications.

1

Create a plain text password variable

Create a String variable called rawPassword and set it to the exact value "mySecret123".

Spring Boot

// Create a String variable called rawPassword and assign it "mySecret123"
// Your code here

Hint

Use String rawPassword = "mySecret123"; to store the password.

2

Create a BCryptPasswordEncoder bean

Create a BCryptPasswordEncoder object called passwordEncoder by instantiating new BCryptPasswordEncoder().

Spring Boot

String rawPassword = "mySecret123";
// Create a BCryptPasswordEncoder object called passwordEncoder
// Your code here

Hint

Use BCryptPasswordEncoder passwordEncoder = new BCryptPasswordEncoder(); to create the encoder.

3

Encode the raw password

Use the encode method of passwordEncoder to encode rawPassword. Store the result in a String variable called encodedPassword.

Spring Boot

String rawPassword = "mySecret123";
BCryptPasswordEncoder passwordEncoder = new BCryptPasswordEncoder();
// Encode rawPassword using passwordEncoder.encode and store in encodedPassword
// Your code here

Hint

Call passwordEncoder.encode(rawPassword) and assign it to encodedPassword.

4

Verify the password matches the encoded value

Use the matches method of passwordEncoder to check if rawPassword matches encodedPassword. Store the boolean result in a variable called isMatch.

Spring Boot

String rawPassword = "mySecret123";
BCryptPasswordEncoder passwordEncoder = new BCryptPasswordEncoder();
String encodedPassword = passwordEncoder.encode(rawPassword);
// Use passwordEncoder.matches to check rawPassword against encodedPassword and store in isMatch
// Your code here

Hint

Use passwordEncoder.matches(rawPassword, encodedPassword) to verify the password.

Practice

1. What is the main purpose of using BCryptPasswordEncoder in Spring Boot?

easy

A. To validate email addresses

B. To decode passwords back to plain text

C. To generate random passwords for users

D. To securely encode passwords before storing them

Solution

1. Step 1: Understand BCryptPasswordEncoder role

   BCryptPasswordEncoder is used to convert plain passwords into a secure encoded form.

2. Step 2: Identify correct purpose

   It does not decode or generate passwords, only encodes them securely.

3. Final Answer:

   To securely encode passwords before storing them -> Option D

4. Quick Check:

   Password encoding = Secure storage [OK]

Hint: BCrypt encodes, never decodes passwords [OK]

Common Mistakes:

• Thinking BCrypt can decode passwords
• Confusing encoding with password generation
• Using it for unrelated tasks like email validation

2. Which of the following is the correct way to create a BCryptPasswordEncoder instance in Spring Boot?

easy

A. BCryptPasswordEncoder encoder = BCryptPasswordEncoder();

B. BCryptPasswordEncoder encoder = new BCryptPasswordEncoder();

C. BCryptPasswordEncoder encoder = new BCryptPasswordEncoder.encode();

D. BCryptPasswordEncoder encoder = encode(new BCryptPasswordEncoder());

Solution

1. Step 1: Recall Java object creation syntax

   In Java, to create an object, use the new keyword followed by the constructor.

2. Step 2: Match correct syntax

   BCryptPasswordEncoder encoder = new BCryptPasswordEncoder(); correctly uses new BCryptPasswordEncoder(); to create an instance.

3. Final Answer:

   BCryptPasswordEncoder encoder = new BCryptPasswordEncoder(); -> Option B

4. Quick Check:

   Object creation = new + constructor [OK]

Hint: Use 'new' keyword to create objects in Java [OK]

Common Mistakes:

• Omitting 'new' keyword when creating objects
• Calling methods instead of constructors
• Incorrect method chaining in object creation

3. Given the following code snippet, what will be the output of matches method?

BCryptPasswordEncoder encoder = new BCryptPasswordEncoder();
String rawPassword = "mypassword";
String encodedPassword = encoder.encode(rawPassword);
boolean result = encoder.matches("mypassword", encodedPassword);
System.out.println(result);

medium

A. true

B. false

C. Compilation error

D. Runtime exception

Solution

1. Step 1: Understand encode and matches methods

   The encode method creates a hashed password. The matches method checks if the raw password matches the encoded hash.

2. Step 2: Analyze the code flow

   The raw password "mypassword" is encoded, then matches compares the same raw password with the encoded one, so it returns true.

3. Final Answer:

   true -> Option A

4. Quick Check:

   matches(raw, encoded) = true if same password [OK]

Hint: matches() returns true if raw matches encoded password [OK]

Common Mistakes:

• Assuming encode returns plain text
• Thinking matches compares encoded strings directly
• Expecting false because encoded password looks different

4. Identify the error in the following Spring Boot code snippet for password encoding:

BCryptPasswordEncoder encoder;
String encoded = encoder.encode("secret");

medium

A. String type cannot hold encoded password

B. encode method does not exist in BCryptPasswordEncoder

C. encoder is not initialized before use

D. Missing import statement for BCryptPasswordEncoder

Solution

1. Step 1: Check variable initialization

   The variable encoder is declared but not assigned an instance before calling encode.

2. Step 2: Understand consequences

   Using an uninitialized object causes a NullPointerException at runtime.

3. Final Answer:

   encoder is not initialized before use -> Option C

4. Quick Check:

   Uninitialized objects cause runtime errors [OK]

Hint: Always initialize objects before calling methods [OK]

Common Mistakes:

• Forgetting to create new instance with 'new'
• Assuming declaration equals initialization
• Ignoring runtime NullPointerException

5. You want to store user passwords securely in your Spring Boot application. Which approach correctly uses BCryptPasswordEncoder to encode and verify passwords during login?

hard

A. Encode password on registration, store encoded; on login, use matches(rawPassword, storedEncodedPassword)

B. Store plain password; on login, encode input and compare with stored plain password

C. Encode password on registration, store encoded; on login, encode input and compare encoded strings directly

D. Encode password on registration, store encoded; on login, decode stored password and compare with input

Solution

1. Step 1: Understand secure password storage

   Passwords must be encoded before storing; plain text storage is insecure.

2. Step 2: Verify password correctly on login

   Use matches(rawPassword, storedEncodedPassword) to check if input matches stored hash without decoding.

3. Final Answer:

   Encode password on registration, store encoded; on login, use matches(rawPassword, storedEncodedPassword) -> Option A

4. Quick Check:

   Use matches() to verify passwords securely [OK]

Hint: Use matches() to check raw vs encoded passwords [OK]

Common Mistakes:

• Comparing encoded strings directly (they differ each time)
• Storing plain text passwords
• Trying to decode encoded passwords (not possible)