alibaba/nacos · error · IllegalArgumentException

Password cannot be null

Error message

Password cannot be null

What it means

Thrown by PasswordEncoderUtil.encode() when the raw password argument is null. This is a precondition check before passing the password to the SafeBcryptPasswordEncoder. The method does not accept null because BCrypt encoding of null would either NPE internally or produce meaningless output.

Source

Thrown at plugin-default-impl/nacos-default-auth-plugin/src/main/java/com/alibaba/nacos/plugin/auth/impl/utils/PasswordEncoderUtil.java:41

 * Password encoder tool.
 *
 * @author nacos
 */
public class PasswordEncoderUtil {
    
    public static Boolean matches(String raw, String encoded) {
        return new SafeBcryptPasswordEncoder().matches(raw, encoded);
    }
    
    /**
     * Encode password.
     *
     * @param raw password
     * @return encoded password
     */
    public static String encode(String raw) {
        if (raw == null) {
            throw new IllegalArgumentException("Password cannot be null");
        }
        if (raw.length() > AuthConstants.MAX_PASSWORD_LENGTH) {
            throw new IllegalArgumentException("Password length must not exceed "
                + AuthConstants.MAX_PASSWORD_LENGTH + " characters");
        }
        return new SafeBcryptPasswordEncoder().encode(raw);
    }
}

View on GitHub (pinned to 9b989acdf1)

Solutions

1. Validate that the password is non-null before calling encode() — check at the controller or form-validation layer.
2. If the password is optional in your flow, provide a default or reject the request with a clear validation error before reaching encode().
3. Ensure all code paths that call createUser or updateUserPassword supply a non-null password.

Example fix

// before
String encoded = PasswordEncoderUtil.encode(password); // NPE if password is null

// after
if (password == null || password.isBlank()) {
    throw new IllegalArgumentException("Password is required");
}
String encoded = PasswordEncoderUtil.encode(password);

// Validate password is non-null before encoding
if (raw == null) {
    throw new IllegalArgumentException("Password is required and cannot be null");
}
String encoded = PasswordEncoderUtil.encode(raw);

public static boolean isEncodablePassword(String raw) {
    return raw != null;
}

try {
    String encoded = PasswordEncoderUtil.encode(rawPassword);
} catch (IllegalArgumentException e) {
    if (e.getMessage().contains("cannot be null")) {
        // handle missing password at the UI/API layer
        return Result.failure("Password is required");
    }
    throw e;
}

When it happens

Trigger: Calling PasswordEncoderUtil.encode(null) directly, or passing a password variable that was never initialized / came from a missing form field / was set to null by upstream code.

Common situations: A user creation or password update form submitted without a password field; a configuration or migration script that passes null for a password; an API call where the password parameter is omitted and defaults to null in the Java binding.

Related errors

• password is blank
• Password length must not exceed {MAX_PASSWORD_LENGTH} charac
• Request parameter `agentSpecCard` should not be null or empt
• Required parameter `agentSpecCard.name` is not present.
• Request parameter `name` should not be null or empty.

AI-assisted analysis of alibaba/nacos@9b989acdf1 (2026-08-14). Data as JSON: /api/errors/544f382abe1ce7ec. Report an issue: GitHub.