Spring Boot Tutorial 0/110 lessons ~6 min read Lesson 44“Production-grade backends”

Password Encryption

Never store passwords in plaintext.

Course progress0%

Focus

3 guided sections

Practice signal

Examples included

Career prep

Foundation builder

Introduction

Never store passwords in plaintext. Never use SHA-256. Use a slow, salted, adaptive hash: BCrypt, Argon2 or scrypt.

Informative example

@Bean PasswordEncoder passwordEncoder() {
  // strength=12 → ~250ms per hash on modern CPU; tune for ~250-500ms
  return new BCryptPasswordEncoder(12);
}

// On signup
String hash = passwordEncoder.encode(rawPassword);

// On login
if (!passwordEncoder.matches(submitted, user.getPasswordHash())) {
  throw new BadCredentialsException("invalid");
}

Best practices

BCrypt strength 12 in 2026; bump as hardware speeds up.
Hash before any logging — never log raw passwords or hashes.
Add login rate-limiting to slow brute-force.

Ready to mark this lesson complete?Track your journey across the entire course.