{"record":{"id":"35cf90fa36d4d68c","repo":"spring-projects/spring-security","slug":"idforencode-idforencode-is-not-found-in-idtopassw","errorCode":null,"errorMessage":"idForEncode {idForEncode}is not found in idToPasswordEncoder {idToPasswordEncoder}","messagePattern":"idForEncode (.+?)is not found in idToPasswordEncoder (.+?)","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"crypto/src/main/java/org/springframework/security/crypto/password/DelegatingPasswordEncoder.java","lineNumber":193,"sourceCode":"\t * {@link #matches(CharSequence, String)}\n\t */\n\tpublic DelegatingPasswordEncoder(String idForEncode, Map<String, PasswordEncoder> idToPasswordEncoder,\n\t\t\tString idPrefix, String idSuffix) {\n\t\tif (idForEncode == null) {\n\t\t\tthrow new IllegalArgumentException(\"idForEncode cannot be null\");\n\t\t}\n\t\tif (idPrefix == null) {\n\t\t\tthrow new IllegalArgumentException(\"prefix cannot be null\");\n\t\t}\n\t\tif (idSuffix == null || idSuffix.isEmpty()) {\n\t\t\tthrow new IllegalArgumentException(\"suffix cannot be empty\");\n\t\t}\n\t\tif (idPrefix.contains(idSuffix)) {\n\t\t\tthrow new IllegalArgumentException(\"idPrefix \" + idPrefix + \" cannot contain idSuffix \" + idSuffix);\n\t\t}\n\n\t\tif (!idToPasswordEncoder.containsKey(idForEncode)) {\n\t\t\tthrow new IllegalArgumentException(\n\t\t\t\t\t\"idForEncode \" + idForEncode + \"is not found in idToPasswordEncoder \" + idToPasswordEncoder);\n\t\t}\n\t\tfor (String id : idToPasswordEncoder.keySet()) {\n\t\t\tif (id == null) {\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tif (!idPrefix.isEmpty() && id.contains(idPrefix)) {\n\t\t\t\tthrow new IllegalArgumentException(\"id \" + id + \" cannot contain \" + idPrefix);\n\t\t\t}\n\t\t\tif (id.contains(idSuffix)) {\n\t\t\t\tthrow new IllegalArgumentException(\"id \" + id + \" cannot contain \" + idSuffix);\n\t\t\t}\n\t\t}\n\t\tthis.idForEncode = idForEncode;\n\t\tthis.passwordEncoderForEncode = idToPasswordEncoder.get(idForEncode);\n\t\tthis.idToPasswordEncoder = new HashMap<>(idToPasswordEncoder);\n\t\tthis.idPrefix = idPrefix;\n\t\tthis.idSuffix = idSuffix;","sourceCodeStart":175,"sourceCodeEnd":211,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/crypto/src/main/java/org/springframework/security/crypto/password/DelegatingPasswordEncoder.java#L175-L211","documentation":"DelegatingPasswordEncoder encodes with the delegate registered under idForEncode. If that id is absent from the supplied idToPasswordEncoder map, no encoder can be selected and the constructor throws this IllegalArgumentException. Note the message text has a missing space after the id (a known message quirk).","triggerScenarios":"Calling new DelegatingPasswordEncoder(idForEncode, idToPasswordEncoder, idPrefix, idSuffix) with an idForEncode key that is not present in the map, e.g. \"bcrypt\" when the map only has \"pbkdf2\".","commonSituations":"Renaming an encoder id in the map but not updating idForEncode; typos like \"bycrypt\"; building the encoder list conditionally so the default encoder is missing at construction time; upgrading Spring Security and assuming an id exists by default.","solutions":["Make idForEncode exactly match one of the keys of idToPasswordEncoder (case-sensitive)","Print the map keySet and the idForEncode value before construction to compare them","Ensure the encoder you want as default is unconditionally put into the map before creating the DelegatingPasswordEncoder","Use PasswordEncoderFactories.createDelegatingPasswordEncoder() which wires a valid default (bcrypt) for you"],"exampleFix":"// before\nMap<String, PasswordEncoder> encoders = Map.of(\"pbkdf2\", new Pbkdf2PasswordEncoder());\nnew DelegatingPasswordEncoder(\"bcrypt\", encoders, \"{\", \"}\");\n// after\nMap<String, PasswordEncoder> encoders = new HashMap<>();\nencoders.put(\"bcrypt\", new BCryptPasswordEncoder());\nnew DelegatingPasswordEncoder(\"bcrypt\", encoders, \"{\", \"}\");","handlingStrategy":"validation","validationCode":"if (!encoders.containsKey(idForEncode)) {\n    throw new IllegalStateException(\"idForEncode '\" + idForEncode + \"' not in encoder keys: \" + encoders.keySet());\n}","typeGuard":null,"tryCatchPattern":"try {\n    return new DelegatingPasswordEncoder(idForEncode, encoders, \"{\", \"}\");\n} catch (IllegalArgumentException e) {\n    log.error(\"Encoder id '{}' not registered; available: {}\", idForEncode, encoders.keySet());\n    throw e;\n}","preventionTips":["Keep encoder ids as constants shared between the map keys and idForEncode","Log idToPasswordEncoder.keySet() at startup to confirm the default is present","Use PasswordEncoderFactories.createDelegatingPasswordEncoder() unless custom ids are required"],"tags":["spring-security","illegal-argument","password-encoding","missing-map-key"],"backgroundTag":"resource-not-found","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}