Package org.springframework.security.crypto.password4j

Class ScryptPassword4jPasswordEncoder

java.lang.Object
org.springframework.security.crypto.password.AbstractValidatingPasswordEncoder
org.springframework.security.crypto.password4j.ScryptPassword4jPasswordEncoder
All Implemented Interfaces:
PasswordEncoder
public class ScryptPassword4jPasswordEncoder extends AbstractValidatingPasswordEncoder
Implementation of PasswordEncoder that uses the Password4j library with SCrypt hashing algorithm.

SCrypt is a memory-hard password hashing algorithm designed to be resistant to hardware brute-force attacks. It includes built-in salt generation and is particularly effective against ASIC and GPU-based attacks. This implementation leverages Password4j's SCrypt support which properly includes the salt in the output hash.

This implementation is thread-safe and can be shared across multiple threads.

Usage Examples: 


 // Using default SCrypt settings (recommended)
 PasswordEncoder encoder = new ScryptPassword4jPasswordEncoder();

 // Using custom SCrypt configuration
 PasswordEncoder customEncoder = new ScryptPassword4jPasswordEncoder(
     ScryptFunction.getInstance(32768, 8, 1, 32));
Since:
7.0
See Also:
  • ScryptFunction
  • AlgorithmFinder.getScryptInstance()

  • Constructor Details

    • ScryptPassword4jPasswordEncoder

      public ScryptPassword4jPasswordEncoder()
      Constructs an SCrypt password encoder using the default SCrypt configuration from Password4j's AlgorithmFinder.

    • ScryptPassword4jPasswordEncoder

      public ScryptPassword4jPasswordEncoder(com.password4j.ScryptFunction scryptFunction)
      Constructs an SCrypt password encoder with a custom SCrypt function.
      Parameters:
      scryptFunction - the SCrypt function to use for encoding passwords, must not be null
      Throws:
      IllegalArgumentException - if scryptFunction is null

  • Method Details