Java Spring Security - User.withDefaultPasswordEncoder is deprecated?

Java

Spring Security

User.withDefaultPasswordEncoder

deprecation

password encoding

Java Spring Security - User.withDefaultPasswordEncoder is deprecated?

System Design practice on Codemia

Work through 120+ system design problems with detailed solutions, from rate limiters to multi-region storage.

Practice system design

Security & Auth Java

Introduction

User.withDefaultPasswordEncoder() is deprecated because it stores a password encoder with the user details in source code, which is insecure for production. The method was intended only for demos and tests. The replacement is to define a PasswordEncoder bean separately and encode passwords explicitly. Spring Security recommends using BCryptPasswordEncoder (or Argon2/SCrypt) as a standalone bean and encoding passwords at registration time, not at user creation time.

The Deprecated Code

java

1// DEPRECATED — do not use in production
2@Bean
3public UserDetailsService users() {
4    UserDetails user = User.withDefaultPasswordEncoder()
5        .username("user")
6        .password("password")
7        .roles("USER")
8        .build();
9
10    UserDetails admin = User.withDefaultPasswordEncoder()
11        .username("admin")
12        .password("admin")
13        .roles("ADMIN")
14        .build();
15
16    return new InMemoryUserDetailsManager(user, admin);
17}

The deprecation warning:

'withDefaultPasswordEncoder()' is deprecated since version 5.x
Using this method is not considered safe for production

Why It Is Deprecated

Plaintext password in source code: The password string "password" is visible in the source. The encoding happens in memory but the raw password is in the codebase.
Hardcoded encoder: The method uses BCryptPasswordEncoder internally, but you have no control over the encoder configuration (strength, algorithm).
Misleading API: Developers copy demo code into production, accidentally shipping in-memory users with weak passwords.

Fix 1: Separate PasswordEncoder Bean (Recommended)

java

1import org.springframework.context.annotation.Bean;
2import org.springframework.context.annotation.Configuration;
3import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
4import org.springframework.security.core.userdetails.User;
5import org.springframework.security.core.userdetails.UserDetails;
6import org.springframework.security.core.userdetails.UserDetailsService;
7import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
8import org.springframework.security.crypto.password.PasswordEncoder;
9import org.springframework.security.provisioning.InMemoryUserDetailsManager;
10
11@Configuration
12@EnableWebSecurity
13public class SecurityConfig {
14
15    @Bean
16    public PasswordEncoder passwordEncoder() {
17        return new BCryptPasswordEncoder();
18    }
19
20    @Bean
21    public UserDetailsService userDetailsService(PasswordEncoder encoder) {
22        UserDetails user = User.builder()
23            .username("user")
24            .password(encoder.encode("password"))  // Encode explicitly
25            .roles("USER")
26            .build();
27
28        UserDetails admin = User.builder()
29            .username("admin")
30            .password(encoder.encode("admin"))
31            .roles("ADMIN")
32            .build();
33
34        return new InMemoryUserDetailsManager(user, admin);
35    }
36}

Fix 2: Use `{bcrypt}` Prefix with DelegatingPasswordEncoder

Spring Security 5+ supports password storage format with prefixes:

java

1@Bean
2public UserDetailsService userDetailsService() {
3    UserDetails user = User.builder()
4        .username("user")
5        .password("{bcrypt}$2a$10$GRLdNijSQMUvl/au9ofL.eDwmoohzzS7.rmNSJZ.0FxO/BTk76klW")
6        .roles("USER")
7        .build();
8
9    return new InMemoryUserDetailsManager(user);
10}
11
12@Bean
13public PasswordEncoder passwordEncoder() {
14    return PasswordEncoderFactories.createDelegatingPasswordEncoder();
15}

PasswordEncoderFactories.createDelegatingPasswordEncoder() detects the prefix ({bcrypt}, {argon2}, {scrypt}, {noop}) and uses the appropriate encoder.

Generate BCrypt Hash for Hardcoded Users

java

1// Generate a hash to paste into your config
2BCryptPasswordEncoder encoder = new BCryptPasswordEncoder();
3System.out.println("{bcrypt}" + encoder.encode("password"));
4// {bcrypt}$2a$10$GRLdNijSQMUvl/au9ofL.eDwmoohzzS7.rmNSJZ.0FxO/BTk76klW

Fix 3: Database-Backed UserDetailsService (Production)

For production, users should come from a database, not in-memory:

java

1@Service
2public class CustomUserDetailsService implements UserDetailsService {
3
4    private final UserRepository userRepository;
5    private final PasswordEncoder passwordEncoder;
6
7    public CustomUserDetailsService(UserRepository userRepository,
8                                     PasswordEncoder passwordEncoder) {
9        this.userRepository = userRepository;
10        this.passwordEncoder = passwordEncoder;
11    }
12
13    @Override
14    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
15        AppUser user = userRepository.findByUsername(username)
16            .orElseThrow(() -> new UsernameNotFoundException("User not found: " + username));
17
18        return User.builder()
19            .username(user.getUsername())
20            .password(user.getPasswordHash())  // Already encoded in DB
21            .roles(user.getRoles().toArray(new String[0]))
22            .build();
23    }
24}

Registration Service

java

1@Service
2public class RegistrationService {
3
4    private final UserRepository userRepository;
5    private final PasswordEncoder passwordEncoder;
6
7    public RegistrationService(UserRepository repo, PasswordEncoder encoder) {
8        this.userRepository = repo;
9        this.passwordEncoder = encoder;
10    }
11
12    public void register(String username, String rawPassword) {
13        AppUser user = new AppUser();
14        user.setUsername(username);
15        user.setPasswordHash(passwordEncoder.encode(rawPassword));  // Encode at registration
16        user.setRoles(Set.of("USER"));
17        userRepository.save(user);
18    }
19}

Fix 4: `{noop}` for Tests Only

For unit tests where you do not want hashing overhead:

java

1@Bean
2public UserDetailsService testUsers() {
3    UserDetails user = User.builder()
4        .username("testuser")
5        .password("{noop}password")  // No encoding — plaintext, test only
6        .roles("USER")
7        .build();
8    return new InMemoryUserDetailsManager(user);
9}

{noop} tells the DelegatingPasswordEncoder to store and compare passwords as plaintext. Never use in production.

Common Pitfalls

Using withDefaultPasswordEncoder in production: The method is fine for quick demos but should never appear in production code. It stores the raw password in source code and provides no control over the encoding algorithm or strength.
Forgetting the PasswordEncoder bean: Without a PasswordEncoder bean, Spring Security throws There is no PasswordEncoder mapped for the id "null". Always define a PasswordEncoder bean, even if it is just PasswordEncoderFactories.createDelegatingPasswordEncoder().
Double-encoding passwords: If you call passwordEncoder.encode(password) during registration AND the authentication flow also encodes, the password will never match. Encode once at registration, then the framework compares the raw login password against the stored hash.
Using MD5 or SHA-256 for password hashing: These are cryptographic hash functions, not password hashing functions. They are fast, which makes them vulnerable to brute-force attacks. Use BCrypt, Argon2, or SCrypt — these are intentionally slow.
Hardcoding BCrypt hashes without the {bcrypt} prefix: If using DelegatingPasswordEncoder, stored passwords must have the algorithm prefix (e.g., {bcrypt}$2a$...). Without the prefix, authentication fails with There is no PasswordEncoder mapped for the id "null".

Summary

User.withDefaultPasswordEncoder() is deprecated — use User.builder() with an explicit PasswordEncoder bean
Define BCryptPasswordEncoder as a @Bean and call .encode() on passwords
Use DelegatingPasswordEncoder with {bcrypt} prefixes for flexibility
In production, store encoded passwords in a database and load them via UserDetailsService
Use {noop} prefix only in tests — never in production
Always define a PasswordEncoder bean to avoid "no PasswordEncoder mapped" errors

System Design Fundamentals

Build a strong foundation in designing scalable, reliable distributed systems.

View the course

Track what you have practised

A free account saves your progress, solutions and study plan across every problem on Codemia.

System Design practice on Codemia

Work through 120+ system design problems with detailed solutions, from rate limiters to multi-region storage.

Practice system design

Java Spring Security - User.withDefaultPasswordEncoder is deprecated?

System Design practice on Codemia

Introduction

The Deprecated Code

Why It Is Deprecated

Fix 1: Separate PasswordEncoder Bean (Recommended)

Fix 2: Use {bcrypt} Prefix with DelegatingPasswordEncoder

Generate BCrypt Hash for Hardcoded Users

Fix 3: Database-Backed UserDetailsService (Production)

Registration Service

Fix 4: {noop} for Tests Only

Common Pitfalls

Summary

Related reading

System Design Fundamentals

Track what you have practised

System Design practice on Codemia

Fix 2: Use `{bcrypt}` Prefix with DelegatingPasswordEncoder

Fix 4: `{noop}` for Tests Only