Password encoding with BCrypt in Spring Boot - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is BCrypt in the context of password encoding?

BCrypt is a password hashing function designed to securely encode passwords by adding a salt and using multiple rounds of hashing to protect against brute-force attacks.

beginner

How do you create a BCrypt password encoder in Spring Boot?

You create a BCrypt password encoder by defining a bean like this:

@Bean
public PasswordEncoder passwordEncoder() {
    return new BCryptPasswordEncoder();
}

intermediate

Why is it important to use a salt in password encoding?

A salt adds random data to the password before hashing, making each hash unique even if two users have the same password. This prevents attackers from using precomputed tables to crack passwords.

beginner

How do you verify a raw password against a BCrypt encoded password in Spring Boot?

Use the matches method of PasswordEncoder:

passwordEncoder.matches(rawPassword, encodedPassword)

It returns true if the raw password matches the encoded one.

intermediate

What is the default strength (log rounds) of BCryptPasswordEncoder in Spring Boot?

The default strength is 10, which means 2^10 (1024) rounds of hashing are applied to make password encoding slower and more secure.

What does BCrypt add to passwords before hashing to improve security?

A A timestamp

B A fixed prefix

C A random salt

D A user ID

BCrypt adds a random salt to each password before hashing to ensure uniqueness and prevent rainbow table attacks.

Which Spring Boot class is commonly used for BCrypt password encoding?

A PasswordEncoderFactory

B PasswordHasher

C HashingService

D BCryptPasswordEncoder

BCryptPasswordEncoder is the standard Spring Boot class for encoding passwords with BCrypt.

How do you check if a raw password matches an encoded BCrypt password in Spring Boot?

A passwordEncoder.matches(raw, encoded)

B passwordEncoder.encode(raw) == encoded

C passwordEncoder.verify(raw, encoded)

D passwordEncoder.check(raw, encoded)

The matches method compares a raw password with an encoded one and returns true if they match.

What is the effect of increasing the strength parameter in BCryptPasswordEncoder?

A It changes the hash algorithm to SHA-256

B It increases the number of hashing rounds, making encoding slower and more secure

C It disables salting

D It decreases the password length

Increasing strength increases the number of hashing rounds, which slows down encoding but improves security.

Why should you never store raw passwords in your database?

A Because raw passwords can be stolen and used directly by attackers

B Because raw passwords take more space

C Because raw passwords are hard to read

D Because raw passwords are encrypted automatically

Storing raw passwords is dangerous because if the database is compromised, attackers get direct access to user passwords.

Explain how BCrypt protects passwords and why it is preferred over simple hashing.

Think about how adding randomness and time cost helps security.

Describe how to implement password encoding and verification using BCrypt in a Spring Boot application.

Focus on the key methods and bean setup.