{"record":{"id":"707216669d6e9854","repo":"spring-projects/spring-security","slug":"the-name-of-the-password-encoder-is-improperly-for","errorCode":null,"errorMessage":"The name of the password encoder is improperly formatted or incomplete. The format should be '%sENCODER%spassword'.","messagePattern":"The name of the password encoder is improperly formatted or incomplete\\. The format should be '(.+?)ENCODER(.+?)password'\\.","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"crypto/src/main/java/org/springframework/security/crypto/password/DelegatingPasswordEncoder.java","lineNumber":307,"sourceCode":"\t\t@Override\n\t\tprotected String encodeNonNullPassword(String rawPassword) {\n\t\t\tthrow new UnsupportedOperationException(\"encode is not supported\");\n\t\t}\n\n\t\t@Override\n\t\tprotected boolean matchesNonNull(String rawPassword, String prefixEncodedPassword) {\n\t\t\tString id = extractId(prefixEncodedPassword);\n\t\t\tif (id != null && !id.isBlank()) {\n\t\t\t\tthrow new IllegalArgumentException(String.format(NO_PASSWORD_ENCODER_MAPPED, id));\n\t\t\t}\n\t\t\tif (prefixEncodedPassword != null && !prefixEncodedPassword.isBlank()) {\n\t\t\t\tint start = prefixEncodedPassword.indexOf(DelegatingPasswordEncoder.this.idPrefix);\n\t\t\t\tint end = prefixEncodedPassword.indexOf(DelegatingPasswordEncoder.this.idSuffix, start);\n\t\t\t\tif (start < 0 && end < 0) {\n\t\t\t\t\tthrow new IllegalArgumentException(NO_PASSWORD_ENCODER_PREFIX);\n\t\t\t\t}\n\t\t\t}\n\t\t\tthrow new IllegalArgumentException(String.format(MALFORMED_PASSWORD_ENCODER_PREFIX,\n\t\t\t\t\tDelegatingPasswordEncoder.this.idPrefix, DelegatingPasswordEncoder.this.idSuffix));\n\t\t}\n\n\t}\n\n}\n","sourceCodeStart":289,"sourceCodeEnd":314,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/crypto/src/main/java/org/springframework/security/crypto/password/DelegatingPasswordEncoder.java#L289-L314","documentation":"The stored password contains the prefix or suffix somewhere but is not a well-formed '{id}password' string (e.g. prefix present without suffix, or suffix before prefix). The id cannot be extracted, so the fallback matcher throws this IllegalArgumentException describing the required format.","triggerScenarios":"matches() with a prefixEncodedPassword such as '{bcrypt$2a$...' (missing '}'), 'bcrypt}...' (missing '{'), or '{bcrypt' — strings where indexOf(idPrefix) or indexOf(idSuffix) checks pass individually but no valid '{id}' segment exists.","commonSituations":"Manual string manipulation/truncation of stored passwords (column length limits cutting off the tail); accidental double-prefixing like '{{noop}secret'; encoding artifacts or data corruption in the credentials column.","solutions":["Rewrite the stored value as a complete '{id}encodedPassword' string and verify it parses (extract the id between '{' and first '}')","Check whether the column length truncated the value and widen the column, then re-encode the password","Regenerate the credential using delegatingPasswordEncoder.encode(rawPassword) so the format is guaranteed correct","Check for accidental double braces and strip the extra layer"],"exampleFix":"// before\n// stored (truncated): '{bcrypt$2a$10$dXJ3'\n// after\n// stored: '{bcrypt}$2a$10$dXJ3SW6G7P50lGmMkkmwe.20cQQubK3.HZWzG3YB1tlRy.fqvM/BG'\n","handlingStrategy":"validation","validationCode":"boolean wellFormed = storedPassword != null\n        && storedPassword.startsWith(\"{\")\n        && storedPassword.indexOf('}') > 1;\nif (!wellFormed) {\n    log.warn(\"Malformed stored password, missing {id} wrapper\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    return encoder.matches(rawPassword, storedPassword);\n} catch (IllegalArgumentException e) {\n    log.error(\"Stored password not in '{id}password' format: {}\", e.getMessage());\n    return false;\n}","preventionTips":["Never hand-edit or truncate stored password values; check column length (>= 100 chars recommended)","Generate stored passwords only via delegatingPasswordEncoder.encode()","Validate format at import/seed time: starts with '{', contains '}', id between them non-empty"],"tags":["spring-security","password-matching","malformed-format","data-corruption"],"backgroundTag":"invalid-argument-format","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}