How should passwords be stored with Spring Security PasswordEncoder?

Stores salted adaptive password hashes, supports algorithm migration, and separates password verification from encryption.

1Say itAnswer out loud first

2CompareCompare with Core answer

3RefineRefine with Stronger and Advanced

TL;DR

I store passwords with a modern adaptive password hash through Spring Security's PasswordEncoder, not plaintext, reversible encryption, or a fast general-purpose hash. Algorithms such as bcrypt, PBKDF2, scrypt, or Argon2 use a salt and configurable work factor. Spring's DelegatingPasswordEncoder stores an algorithm identifier with the encoded value so existing hashes can still be verified while new passwords use the current policy.

Full answer below

Practice focus

PasswordEncoder, adaptive hashing, salts, DelegatingPasswordEncoder, work factors, upgrades, and credential handling.

Answer first

Answer path

Core answer first, then checkpoints toward a stronger answer.

Start
Core answer
Start here. This is the direct spoken answer to practice first.
Overview
Passwords are verified through a deliberately expensive one-way function, never decrypted from storage.
I store passwords with a modern adaptive password hash through Spring Security's PasswordEncoder, not plaintext, reversible encryption, or a fast general-purpose hash. Algorithms such as bcrypt, PBKDF2, scrypt, or Argon2 use a salt and configurable work factor. Spring's DelegatingPasswordEncoder stores an algorithm identifier with the encoded value so existing hashes can still be verified while new passwords use the current policy.
Checkpoint
Stronger answer
Optional upgrade with examples, trade-offs, and sharper phrasing.
The work factor is calibrated on production-class hardware so verification is expensive for attackers but acceptable for login capacity. On a successful login, can identify an old or weak hash and the application can re-encode the password with the current policy. A server-side pepper can add defense when managed in a separate secret store, but it complicates rotation and recovery. Passwords and hashes never enter logs, analytics, or exception messages.

Review signals

Use these to catch weak phrasing, shallow reasoning, and risky claims.

Common mistakesCandidateCommon mistakesMistakes that weaken the answer or signal shallow understanding.Open details

Details

Encrypting passwords for later decryption.
Using SHA-256 directly without an adaptive scheme.
Hard-coding one algorithm with no migration path.

How should passwords be stored with Spring Security PasswordEncoder?

Practice focus

Answer path

Overview

Review signals

Follow-up prompts

Continue the section

Tech stacks

Skill areas

Suggest an improvement

Found this answer useful?