SPRING CONCEPTS
BCrypt
Spring Concepts / BCrypt
BCrypt stores a salted, deliberately expensive password hash.
Understand the idea
encode creates a hash using a salt and work factor. matches checks a submitted password against that encoded result. Hashing is one-way; there is no password-decryption step. BCrypt’s input length limit is measured in bytes, which matters for non-ASCII text.
A concrete example
passwords.encode(password);
passwords.matches(submittedPassword, storedHash);In the application
SecurityConfig uses BCryptPasswordEncoder(12). AuthController also rejects passwords exceeding 72 UTF-8 bytes.
Do not compare independently generated hash strings: salts make them different. Use matches.