Understanding BCrypt in Spring Security: From Plain Passwords to Secure Authentication

BCrypt in Spring Security

Introduction

When developing a web application, one of the most important security requirements is protecting user passwords. Users trust an application with sensitive information, and storing passwords incorrectly can lead to serious security breaches. For this reason, Spring Security provides BCrypt, a password hashing algorithm specifically designed for secure password storage.

Why We Should Not Store Raw Passwords

The simplest approach is to store passwords directly in the database.

Example:

Username: john

Password: password123

Database:

john → password123

Although this approach works, it is extremely dangerous. If an attacker gains access to the database, every user’s password becomes immediately visible. This can result in unauthorized access to user accounts and potentially other services where users reuse the same password.

Therefore, raw passwords should never be stored in a database.

What Is Hashing?

Hashing is the process of converting data into a fixed-length string using a mathematical algorithm.

Example:

password123

↓

Hash Function

↓

ef92b778bafe771e89245…

The important property of hashing is that it is a one-way operation. The original password cannot be directly recovered from the hash.

Instead of storing:

john → password123

we store:

john → ef92b778bafe771e89245…

During login, the entered password is hashed again and compared with the stored hash.

Problems with Traditional Hashing Algorithms

Many beginners think using algorithms such as SHA-256 is enough.

Example:

password123

↓

SHA-256

↓

ef92b778bafe771e89245…

The problem is that hashing the same password always produces the same output.

For example:

password123 → ef92b778…

password123 → ef92b778…

password123 → ef92b778…

As a result, if multiple users have the same password, they will have identical hashes in the database.

This gives attackers valuable information.

Rainbow Table Attacks

Attackers maintain huge databases containing millions of common passwords and their corresponding hashes.

Example:

password123 → ef92b778…

admin123 → 240be518…

qwerty → 65e84be3…

If an attacker steals a database containing SHA-256 hashes, they can quickly compare the hashes against their precomputed database and discover many passwords.

This type of attack is known as a Rainbow Table Attack.

The Concept of Salt

To solve this problem, a random value called a salt is added to the password before hashing.

Example:

Password: password123

Salt: ABC123

Combined Value:

password123ABC123

↓

Hash Function

↓

Hash A

Another user:

Password: password123

Salt: XYZ999

Combined Value:

password123XYZ999

↓

Hash Function

↓

Hash B

Although both users have the same password, their hashes become completely different.

This makes rainbow table attacks much less effective.

Why BCrypt Was Created

Even with salting, algorithms such as SHA-256 are extremely fast.

Modern hardware can calculate billions of SHA-256 hashes every second.

This creates another problem.

If an attacker steals password hashes, they can attempt billions of password guesses per second.

To address this issue, BCrypt was designed specifically for password storage.

The primary goal of BCrypt is not speed.

The primary goal is security.

BCrypt intentionally performs expensive computations to slow down password verification.

This makes brute-force attacks significantly more difficult.

Features of BCrypt

1. Automatic Salt Generation

BCrypt automatically generates a unique random salt for every password.

Developers do not need to manually create or manage salts.

Every call to encode() generates a new salt internally.

2. Different Hashes for the Same Password

Using BCrypt:

password123

↓

Hash 1

password123

↓

Hash 2

password123

↓

Hash 3

All hashes are different because a different random salt is generated each time.

3. Built-In Salt Storage

BCrypt stores the salt inside the generated hash.

A typical BCrypt hash contains:

• Algorithm information
• Cost factor
• Salt
• Final hash value

This allows BCrypt to retrieve the salt later during authentication.

4. Adjustable Cost Factor

BCrypt supports a configurable work factor called the cost factor.

Examples:

Cost 10

Cost 12

Cost 14

Higher values require more computational effort.

This makes brute-force attacks slower and more expensive.

How BCrypt Authentication Works

Many developers wonder how login works if BCrypt generates a different hash every time.

The answer lies in the stored salt.

During Registration:

User enters password123

↓

BCrypt generates random salt

↓

BCrypt creates hash

↓

Store hash in database

During Login:

User enters password123

↓

Spring Security reads stored BCrypt hash

↓

Extracts the salt from the hash

↓

Uses the same salt and password

↓

Generates a comparison hash

↓

Compares results

If both hashes match, authentication succeeds.

The salt is remembered because it is embedded inside the stored BCrypt hash.

BCrypt in Spring Security

Spring Security provides BCryptPasswordEncoder for password hashing.

Configuration:

@Bean

public PasswordEncoder passwordEncoder() {

return new BCryptPasswordEncoder();

}

During Registration:

String encodedPassword = passwordEncoder.encode(rawPassword);

user.setPassword(encodedPassword);

userRepository.save(user);

During Login:

passwordEncoder.matches(rawPassword, storedPassword);

Spring Security automatically handles salt extraction and hash comparison.

Advantages of BCrypt

1. Passwords are never stored in plain text.
2. Each password receives a unique salt.
3. Identical passwords generate different hashes.
4. Rainbow table attacks become ineffective.
5. Brute-force attacks become significantly slower.
6. Salt management is automatic.
7. Supported directly by Spring Security.
8. Widely used and trusted in production systems.

BCrypt vs Encryption

Encryption:

Password

↓

Encrypt

↓

Encrypted Data

↓

Decrypt

↓

Original Password

Encryption is reversible.

Hashing:

Password

↓

Hash

↓

Stored Hash

Hashing is one-way.

For password storage, we only need verification, not recovery.

Therefore, password hashing is preferred over encryption.

Conclusion

BCrypt is one of the most widely used password hashing algorithms in modern web applications. It improves security by automatically generating salts, producing different hashes for identical passwords, and slowing down password verification to resist brute-force attacks. Spring Security integrates BCrypt through BCryptPasswordEncoder, making password protection simple and reliable. By storing BCrypt hashes instead of raw passwords, developers can significantly improve the security of their applications and protect users from password-related attacks.