Snippet

Hashing User Passwords with BCryptPasswordEncoder

Storing passwords in plain text is a severe vulnerability. Spring Security provides BCryptPasswordEncoder to securely hash passwords with automatic salting. The encode() method transforms cleartext into a secure hash, while matches() validates user input against stored hashes without decrypting them.

snippet.java

java

import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.stereotype.Service;
 
@Service
public class UserService {
    private final BCryptPasswordEncoder passwordEncoder = new BCryptPasswordEncoder();
 
    public String registerUser(String rawPassword) {
        return passwordEncoder.encode(rawPassword);
    }
 
    public boolean verifyPassword(String rawPassword, String encodedPassword) {
        return passwordEncoder.matches(rawPassword, encodedPassword);
    }
}

spring

Breakdown

private final BCryptPasswordEncoder passwordEncoder = new BCryptPasswordEncoder();

Instantiates the BCrypt encoder utility for hashing and checking passwords.

return passwordEncoder.encode(rawPassword);

Hashes the plaintext password using the BCrypt hashing algorithm with a random salt.

return passwordEncoder.matches(rawPassword, encodedPassword);

Verifies whether the raw password matches the previously hashed password.

Previous snippet Next snippet

More Beginner Java exercises →

Hashing User Passwords with BCryptPasswordEncoder

Related