{"id":1951,"date":"2019-10-04T12:00:00","date_gmt":"2019-10-04T10:00:00","guid":{"rendered":"https:\/\/kindsonthegenius.com\/blog\/spring-security-tutorial-3-encoding-your-password\/"},"modified":"2026-07-05T03:24:37","modified_gmt":"2026-07-05T01:24:37","slug":"spring-security-tutorial-3-encoding-your-password","status":"publish","type":"post","link":"https:\/\/kindsonthegenius.com\/blog\/spring-security-tutorial-3-encoding-your-password\/","title":{"rendered":"Spring Security Tutorial 3 \u2013 Encoding Your Password"},"content":{"rendered":"<p>If you remember from <a href=\"https:\/\/kindsonthegenius.com\/tempsite\/spring-security-tutorial-storing-user-credential-in-mysql-database\/\" target=\"_blank\" rel=\"noopener noreferrer\">Tutorial 2<\/a>, we stored our password in MySQL database in plain text. Now, this is not ideal way since plain text password are vulnerable to attack.<\/p>\n<ul>\n<li><a href=\"https:\/\/kindsonthegenius.com\/tempsite\/introduction-to-spring-security-a-practical-tutorial\/\">Tutorial 1 &#8211; Introduction to Spring Security\u00a0<\/a><\/li>\n<li><a href=\"https:\/\/kindsonthegenius.com\/tempsite\/spring-security-tutorial-storing-user-credential-in-mysql-database\/\">Tutorial 2 &#8211; Storing Login Details in MySQL<\/a><\/li>\n<li><a href=\"https:\/\/kindsonthegenius.com\/tempsite\/spring-security-tutorial-3-encoding-your-password\/\">Tutorial 3 &#8211; Using BCrypt Password Encoder<\/a><\/li>\n<li><a href=\"https:\/\/kindsonthegenius.com\/tempsite\/spring-security-tutorial-4-create-your-own-login-form\/\">Tutorial 4 &#8211; Custom Login Form<\/a><\/li>\n<\/ul>\n<p>In this tutorial, we would learn about different encoders we can use for to encoder out password. Then we would see how to generate an encoded password using BCrypt. Finally, we would set a password encoder and test the application.<\/p>\n<p>Before we follow the steps, here are the passwordencoders that can be used and their description<\/p>\n<ul>\n<li>ldap &#8211;\u00a0<a title=\"class in org.springframework.security.crypto.password\" href=\"https:\/\/docs.spring.io\/spring-security\/site\/docs\/current\/api\/org\/springframework\/security\/crypto\/password\/LdapShaPasswordEncoder.html\" target=\"_blank\" rel=\"noopener\">LdapShaPasswordEncoder<\/a><\/li>\n<li>noop &#8211;\u00a0<a title=\"class in org.springframework.security.crypto.password\" href=\"https:\/\/docs.spring.io\/spring-security\/site\/docs\/current\/api\/org\/springframework\/security\/crypto\/password\/NoOpPasswordEncoder.html\" target=\"_blank\" rel=\"noopener\">NoOpPasswordEncoder<\/a><\/li>\n<li>pbkdf2 &#8211;\u00a0<a title=\"class in org.springframework.security.crypto.password\" href=\"https:\/\/docs.spring.io\/spring-security\/site\/docs\/current\/api\/org\/springframework\/security\/crypto\/password\/Pbkdf2PasswordEncoder.html\" target=\"_blank\" rel=\"noopener\">Pbkdf2PasswordEncoder<\/a><\/li>\n<li>scrypt &#8211;\u00a0<a title=\"class in org.springframework.security.crypto.scrypt\" href=\"https:\/\/docs.spring.io\/spring-security\/site\/docs\/current\/api\/org\/springframework\/security\/crypto\/scrypt\/SCryptPasswordEncoder.html\" target=\"_blank\" rel=\"noopener\">SCryptPasswordEncoder<\/a><\/li>\n<li>SHA-1 &#8211;\u00a0new MessageDigestPasswordEncoder(&#8220;SHA-1&#8221;)<\/li>\n<li>SHA-256 &#8211;\u00a0new MessageDigestPasswordEncoder(&#8220;SHA-256&#8221;)<\/li>\n<li>sha256 &#8211;\u00a0<a title=\"class in org.springframework.security.crypto.password\" href=\"https:\/\/docs.spring.io\/spring-security\/site\/docs\/current\/api\/org\/springframework\/security\/crypto\/password\/StandardPasswordEncoder.html\" target=\"_blank\" rel=\"noopener\">StandardPasswordEncoder<\/a><\/li>\n<li>MD4 &#8211;\u00a0<a title=\"class in org.springframework.security.crypto.password\" href=\"https:\/\/docs.spring.io\/spring-security\/site\/docs\/current\/api\/org\/springframework\/security\/crypto\/password\/Md4PasswordEncoder.html\" target=\"_blank\" rel=\"noopener\">Md4PasswordEncoder<\/a>\u00a0&#8211; <a href=\"http:\/\/www.unit-conversion.info\/texttools\/md4\/\" target=\"_blank\" rel=\"noopener\">Generate Tool<\/a><\/li>\n<li>MD5 &#8211;\u00a0new MessageDigestPasswordEncoder(&#8220;MD5&#8221;)\u00a0\u00a0&#8211; <a href=\"http:\/\/www.unit-conversion.info\/texttools\/md5\/\" target=\"_blank\" rel=\"noopener\">Generate Tool<\/a><\/li>\n<li>argon2 &#8211;\u00a0<a title=\"class in org.springframework.security.crypto.argon2\" href=\"https:\/\/docs.spring.io\/spring-security\/site\/docs\/current\/api\/org\/springframework\/security\/crypto\/argon2\/Argon2PasswordEncoder.html\" target=\"_blank\" rel=\"noopener\">Argon2PasswordEncoder<\/a><\/li>\n<li>bcrypt &#8211;\u00a0<a style=\"color: #e74c3c; outline: 0px;\" title=\"class in org.springframework.security.crypto.bcrypt\" href=\"https:\/\/docs.spring.io\/spring-security\/site\/docs\/current\/api\/org\/springframework\/security\/crypto\/bcrypt\/BCryptPasswordEncoder.html\" target=\"_blank\" rel=\"noopener\">BCryptPasswordEncoder<\/a>\u00a0(Also used for encoding) &#8211; <a href=\"https:\/\/www.browserling.com\/tools\/bcrypt\" target=\"_blank\" rel=\"noopener\">Generate Tool<\/a><\/li>\n<\/ul>\n<p>I&#8217;m not going to discuss all these encoders one by one. But I recommend you read them up to know the merits and demerits<\/p>\n<p>We would use BCrypt which is\u00a0is the default password hash algorithm used for\u00a0<a title=\"OpenBSD\" href=\"https:\/\/en.wikipedia.org\/wiki\/OpenBSD\" target=\"_blank\" rel=\"noopener\">OpenBSD<\/a><sup id=\"cite_ref-original_2-0\" class=\"reference\"><\/sup>\u00a0and other systems including some\u00a0<a title=\"Linux distribution\" href=\"https:\/\/en.wikipedia.org\/wiki\/Linux_distribution\" target=\"_blank\" rel=\"noopener\">Linux distributions<\/a>\u00a0 as well as\u00a0<a title=\"\" href=\"https:\/\/en.wikipedia.org\/wiki\/SUSE_Linux\" target=\"_blank\" rel=\"noopener\">SUSE Linux<\/a>. According to Wikipedia, &#8220;it incorporates a\u00a0<a title=\"Salt (cryptography)\" href=\"https:\/\/en.wikipedia.org\/wiki\/Salt_(cryptography)\" target=\"_blank\" rel=\"noopener\">salt<\/a>\u00a0to protect against\u00a0<a title=\"Rainbow table\" href=\"https:\/\/en.wikipedia.org\/wiki\/Rainbow_table\" target=\"_blank\" rel=\"noopener\">rainbow table<\/a>\u00a0attacks. It is also an adaptive function which means that over time, the iteration count can be increased to make it slower, therefore it remains resistant to\u00a0<a title=\"Brute-force search\" href=\"https:\/\/en.wikipedia.org\/wiki\/Brute-force_search\" target=\"_blank\" rel=\"noopener\">brute-force search<\/a>\u00a0attacks even with very high computation power.&#8221;<sup id=\"cite_ref-3\" class=\"reference\"><\/sup><\/p>\n<p>Follow the steps below to add BcryptEncoder to our application.<\/p>\n<p><strong>Step 1:<\/strong> Visit\u00a0https:\/\/www.browserling.com\/tools\/bcrypt and generate two passwords: abcd and 1234<\/p>\n<p><strong>Step 2:<\/strong> Open the userdb database we created in Tutorial 2<\/p>\n<p><strong>Step 3:<\/strong> Create two records: user1 with password generated for 1234; user2 with password generated for abcd<\/p>\n<p><strong>Step 4:<\/strong> Open the AppSecurityConfig file and replace the<\/p>\n<p><!-- HTML generated using hilite.me --><\/p>\n<pre style=\"margin: 0; line-height: 125%;\">provider<span style=\"color: #333333;\">.<\/span><span style=\"color: #0000cc;\">setPasswordEncoder<\/span><span style=\"color: #333333;\">(<\/span>NoOpPasswordEncoder<span style=\"color: #333333;\">.<\/span><span style=\"color: #0000cc;\">getInstance<\/span><span style=\"color: #333333;\">());<\/span>\n<\/pre>\n<p>&nbsp;<\/p>\n<p>with this line<\/p>\n<pre style=\"margin: 0; line-height: 125%;\">provider<span style=\"color: #333333;\">.<\/span><span style=\"color: #0000cc;\">setPasswordEncoder<\/span><span style=\"color: #333333;\">(<\/span><span style=\"color: #008800; font-weight: bold;\">new<\/span> BCryptPasswordEncoder<span style=\"color: #333333;\">());<\/span>\n<\/pre>\n<p>&nbsp;<\/p>\n<p>At\u00a0 this point, the file would be as shown below:<\/p>\n<p><a href=\"https:\/\/www.kindsonthegenius.com\/wp-content\/uploads\/2020\/09\/PassWord-Encoder.jpg\"><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-1259 aligncenter\" src=\"https:\/\/www.kindsonthegenius.com\/wp-content\/uploads\/2020\/09\/PassWord-Encoder.jpg\" alt=\"\" width=\"805\" height=\"435\" \/><\/a><\/p>\n<p>&nbsp;<\/p>\n<p><strong>Step 5<\/strong> &#8211; Launched the application<\/p>\n<p><strong>Step 6<\/strong> &#8211; Enter the username &#8216;user1&#8217; and password &#8216;1234&#8217; and check that you can login<\/p>\n<p><strong>Step 7<\/strong> &#8211; Also try for &#8216;user2&#8217; and &#8216;abcd&#8217;<\/p>\n<p>&nbsp;<\/p>\n<p>If you are up to this point, then congratulations, you are doing great!<\/p>\n<p>The next tutorial, <a href=\"https:\/\/kindsonthegenius.com\/tempsite\/spring-security-tutorial-4-create-your-own-login-form\/\" target=\"_blank\" rel=\"noopener noreferrer\">Tutorial 4<\/a>, we would then add our own custom login form.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>If you remember from Tutorial 2, we stored our password in MySQL database in plain text. Now, this is not ideal way since plain text &hellip; <\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"pagelayer_contact_templates":[],"_pagelayer_content":"","footnotes":""},"categories":[414],"tags":[],"class_list":["post-1951","post","type-post","status-publish","format-standard","hentry","category-programming"],"_links":{"self":[{"href":"https:\/\/kindsonthegenius.com\/blog\/wp-json\/wp\/v2\/posts\/1951","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/kindsonthegenius.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/kindsonthegenius.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/kindsonthegenius.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/kindsonthegenius.com\/blog\/wp-json\/wp\/v2\/comments?post=1951"}],"version-history":[{"count":1,"href":"https:\/\/kindsonthegenius.com\/blog\/wp-json\/wp\/v2\/posts\/1951\/revisions"}],"predecessor-version":[{"id":2119,"href":"https:\/\/kindsonthegenius.com\/blog\/wp-json\/wp\/v2\/posts\/1951\/revisions\/2119"}],"wp:attachment":[{"href":"https:\/\/kindsonthegenius.com\/blog\/wp-json\/wp\/v2\/media?parent=1951"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/kindsonthegenius.com\/blog\/wp-json\/wp\/v2\/categories?post=1951"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/kindsonthegenius.com\/blog\/wp-json\/wp\/v2\/tags?post=1951"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}