What is the best practice for storing passwords in a Spring Security application?

Question

Accepted Answer

The best practice is to never store plaintext or reversibly-encrypted passwords at all—instead hash them with a strong, slow, salted one-way algorithm like BCrypt so the original password can't be recovered even if the database is compromised.

Key Points:
• BCryptPasswordEncoder is Spring Security's recommended default, combining automatic salting with a tunable work factor.
• Hashing is one-way by design—there's no decode() method, only encode() and matches() for comparison.
• A unique per-password salt prevents identical passwords from producing identical hashes, defeating rainbow-table attacks.
• The tunable cost factor lets you increase hashing difficulty over time as hardware gets faster, without changing the algorithm.
• Password policies (minimum length/complexity) and breach-checking services complement hashing but don't replace it.

Example:
Even if an attacker exfiltrates the entire user table, properly BCrypt-hashed passwords remain computationally infeasible to reverse, unlike a database storing plaintext or simple MD5 hashes.

Code Example:

```
PasswordEncoder encoder = new BCryptPasswordEncoder();
String hashed = encoder.encode(rawPassword);        // store this
boolean ok = encoder.matches(rawPassword, hashed);   // verify at login
```

Interview Tip:
A concise interview answer is:

"Never store plaintext passwords—hash them with BCryptPasswordEncoder, which combines automatic per-password salting with a tunable, deliberately slow work factor. There's no decoding involved, only encode() at registration and matches() at login, so even a full database breach doesn't directly expose usable passwords."