BCrypt Password Hashing in Java

#Introduction

BCrypt is a password-hashing algorithm designed specifically for storing passwords. It automatically generates a random salt for every password and is resistant to brute-force attacks because it's intentionally slow — and you can make it slower as hardware gets faster.

#Maven Dependency (Spring Boot)

<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-security</artifactId>
</dependency>

(Outside Spring Boot, the spring-security-crypto module alone provides BCryptPasswordEncoder.)

#Encode a Password

import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;

public class Main {
    public static void main(String[] args) {
        BCryptPasswordEncoder encoder = new BCryptPasswordEncoder();

        String password = "admin123";
        String hashedPassword = encoder.encode(password);

        System.out.println("Original Password : " + password);
        System.out.println("BCrypt Hash       : " + hashedPassword);
    }
}

Original Password : admin123
BCrypt Hash       : $2a$10$7uXf1fO0e2Qx9QJ5kJzJ3uN4wGm7hX6v1xJ5wPzD4YvX0M2nY8c7e

#Verify a Password

BCryptPasswordEncoder encoder = new BCryptPasswordEncoder();

String rawPassword = "admin123";
String storedHash = encoder.encode(rawPassword);   // normally loaded from the database

boolean matches = encoder.matches(rawPassword, storedHash);
System.out.println(matches);

true

matches() hashes the entered password using the salt embedded in the stored hash, then compares the results.

#Why Does the Same Password Produce Different Hashes?

BCryptPasswordEncoder encoder = new BCryptPasswordEncoder();
System.out.println(encoder.encode("admin123"));
System.out.println(encoder.encode("admin123"));

$2a$10$abc..............
$2a$10$xyz..............

The password is identical, but each hash is different because BCrypt creates a new random salt on every call. Verification still succeeds for both:

encoder.matches("admin123", hash1);   // true
encoder.matches("admin123", hash2);   // true

#Structure of a BCrypt Hash

$2a$10$7uXf1fO0e2Qx9QJ5kJzJ3uN4wGm7hX6v1xJ5wPzD4YvX0M2nY8c7e

A BCrypt hash is always 60 characters long — size your database column accordingly (VARCHAR(60) or larger, e.g. VARCHAR(100) if you use the delegating encoder's {bcrypt} prefix).

#Spring Security Configuration

@Bean
public PasswordEncoder passwordEncoder() {
    return new BCryptPasswordEncoder();
}

@Autowired
private PasswordEncoder passwordEncoder;

String hash = passwordEncoder.encode("password");
boolean valid = passwordEncoder.matches("password", hash);

#The Cost Factor

new BCryptPasswordEncoder();      // default cost = 10
new BCryptPasswordEncoder(12);    // custom cost

The cost is a logarithm: BCrypt performs 2^cost rounds of its key-setup function. Each +1 doubles the work — cost 12 is 4× slower than cost 10.

A higher cost means:

• more security;
• slower hashing;
• much harder brute-force attacks.

#Why BCrypt Instead of SHA-256?

#The Authentication Flow

#Key Takeaways

• BCrypt is a slow, salted, one-way hash built for passwords.
• The salt and cost are stored inside the 60-character hash.
• The cost factor is logarithmic — each +1 doubles the work.
• Same password → different hashes, but matches() still verifies them.
• Prefer BCrypt (or Argon2) over fast hashes like SHA-256 for passwords.