How does password encoding work in Spring Security (BCryptPasswordEncoder)? स्प्रिंग सिक्योरिटी में पासवर्ड एन्कोडिंग कैसे काम करती है (BCryptPasswordEncoder)?

Spring Security never stores or compares plain-text passwords. A PasswordEncoder bean, typically BCryptPasswordEncoder, hashes the password with a random salt and a configurable work factor (strength) before it is persisted, and the same encoder's matches() method is used to compare a raw login password against the stored hash.

BCrypt is preferred over faster hashes like MD5 or SHA because it's intentionally slow and its work factor can be increased over time as hardware gets faster, making brute-force and rainbow-table attacks impractical even if the password database is leaked.

@Bean
public PasswordEncoder passwordEncoder() {
    return new BCryptPasswordEncoder(12); // strength factor
}

String hashed = passwordEncoder.encode(rawPassword);
boolean matches = passwordEncoder.matches(rawPassword, hashed);