How to Use PasswordEncoder in Spring for Secure Passwords

In Spring, use PasswordEncoder to securely hash passwords before storing them and to verify raw passwords against stored hashes. You typically inject a PasswordEncoder bean like BCryptPasswordEncoder and call encode() to hash and matches() to check passwords.

Syntax

The PasswordEncoder interface provides two main methods:

• String encode(CharSequence rawPassword): Hashes the raw password.
• boolean matches(CharSequence rawPassword, String encodedPassword): Checks if the raw password matches the hashed one.

Spring provides implementations like BCryptPasswordEncoder which uses a strong hashing algorithm.

java

PasswordEncoder encoder = new BCryptPasswordEncoder();
String hashed = encoder.encode("myPassword");
boolean isMatch = encoder.matches("myPassword", hashed);

Example

This example shows how to create a PasswordEncoder bean in a Spring configuration and use it to encode and verify a password.

java

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;

@Configuration
public class SecurityConfig {

    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }
}

// Usage example
public class PasswordService {
    private final PasswordEncoder passwordEncoder;

    public PasswordService(PasswordEncoder passwordEncoder) {
        this.passwordEncoder = passwordEncoder;
    }

    public String hashPassword(String rawPassword) {
        return passwordEncoder.encode(rawPassword);
    }

    public boolean checkPassword(String rawPassword, String hashedPassword) {
        return passwordEncoder.matches(rawPassword, hashedPassword);
    }
}

// Main method to test
public class Main {
    public static void main(String[] args) {
        PasswordEncoder encoder = new BCryptPasswordEncoder();
        String raw = "secret123";
        String hashed = encoder.encode(raw);
        System.out.println("Hashed password: " + hashed);
        System.out.println("Password matches: " + encoder.matches(raw, hashed));
    }
}

Output

Hashed password: $2a$10$... (varies)
Password matches: true

Common Pitfalls

1. Storing raw passwords: Never store plain text passwords; always encode before saving.

2. Using plain encode() for verification: Do not compare encoded strings directly because hashing adds salt; use matches() instead.

3. Reusing the same encoder instance: It's safe and recommended to reuse a PasswordEncoder bean rather than creating new instances repeatedly.

java

/* Wrong way: comparing encoded strings directly (fails because of salt) */
PasswordEncoder encoder = new BCryptPasswordEncoder();
String hash1 = encoder.encode("password");
String hash2 = encoder.encode("password");
boolean wrongCheck = hash1.equals(hash2); // false

/* Right way: use matches() method */
boolean correctCheck = encoder.matches("password", hash1); // true

Quick Reference

• encode(rawPassword): Hashes the password securely.
• matches(rawPassword, encodedPassword): Checks if raw password matches the hash.
• Use BCryptPasswordEncoder for strong hashing.
• Always inject PasswordEncoder as a Spring bean.
• Never store or compare raw passwords directly.

Key Takeaways

Always use PasswordEncoder to hash passwords before storing them.

Use matches() method to verify raw passwords against stored hashes.

BCryptPasswordEncoder is a recommended strong hashing implementation.

Never store or compare raw passwords directly in your code or database.

Inject PasswordEncoder as a Spring bean for reuse and consistency.