pentaho/pentaho-kettle · error · KettleException

Unable to initialize the two way password encoder: No…

Error message

Unable to initialize the two way password encoder: No encoder plugin type specified.

What it means

Encr.init(encoderPluginId) initializes the two-way password encoder by loading a plugin from the PluginRegistry; it throws KettleException when the supplied plugin id is null or empty, because without an encoder plugin id no password encode/decode can be performed.

Solutions

  1. Set the encoder plugin id, e.g. System.setProperty( Const.KETTLE_TWO_WAY_PASSWORD_ENCODER, "kettle" ) (or 'freemarker-style' as configured) before init.
  2. Call KettleEnvironment.init() first, which initializes Encr with the default encoder.
  3. Pass a valid plugin id registered in kettle-password-encoder-plugins.xml.
  4. Guard the call: check Utils.isEmpty(encoderPluginId) and fail with a clear config error.

Example fix

// before
Encr.init( System.getProperty( Const.KETTLE_TWO_WAY_PASSWORD_ENCODER ) ); // null
// after
String id = System.getProperty( Const.KETTLE_TWO_WAY_PASSWORD_ENCODER, "kettle" );
if ( Utils.isEmpty( id ) ) throw new IllegalStateException( "Encoder plugin id required" );
Encr.init( id );
Defensive patterns

Strategy: validation

Validate before calling

String id = System.getProperty( Const.KETTLE_TWO_WAY_PASSWORD_ENCODER );
if ( id == null || id.isEmpty() ) {
  throw new IllegalStateException( "Set " + Const.KETTLE_TWO_WAY_PASSWORD_ENCODER + " before Encr.init" );
}

Try / catch

try {
  Encr.init( encoderPluginId );
} catch ( KettleException e ) {
  throw new IllegalStateException( "Password encoder plugin id missing; check kettle.properties", e );
}

Prevention

When it happens

Trigger: Calling Encr.init(null) or Encr.init("") — e.g. the KETTLE_TWO_WAY_PASSWORD_ENCODER system property / kettle.properties entry is unset and its value is passed straight to init().

Common situations: Standalone/embedded usage of Kettle APIs (Encr, DecryptingDataSource) without initializing the Kettle environment, missing kettle.properties, or the encoder plugin id environment variable removed during migration.

Understand the failure class

Background: "is required", "must be set", "missing required field": configuration validation errors across open-source libraries — this error's family across 36 libraries.

Related errors

AI-assisted analysis of pentaho/pentaho-kettle@f3058517a1 (2026-09-13). Data as JSON: /api/errors/e73315cd36e0d1c5. Report an issue: GitHub.

Appendix: source

Thrown at core/src/main/java/org/pentaho/di/core/encryption/Encr.java:48

 * @author Matt
 * @since 17-12-2003
 *
 */
public class Encr {

  private static TwoWayPasswordEncoderInterface encoder;

  public Encr() {
  }

  @Deprecated
  public boolean init() {
    return true;
  }

  public static void init( String encoderPluginId ) throws KettleException {
    if ( Utils.isEmpty( encoderPluginId ) ) {
      throw new KettleException( "Unable to initialize the two way password encoder: No encoder plugin type specified." );
    }
    PluginRegistry registry = PluginRegistry.getInstance();
    PluginInterface plugin = registry.findPluginWithId( TwoWayPasswordEncoderPluginType.class, encoderPluginId );
    if ( plugin == null ) {
      throw new KettleException( "Unable to find plugin with ID '" + encoderPluginId + "'.  If this is a test, make sure"
        + " kettle-core tests jar is a dependency.  If this is live make sure a kettle-password-encoder-plugins.xml"
        + " exits in the classpath" );
    }
    encoder = (TwoWayPasswordEncoderInterface) registry.loadClass( plugin );

    // Load encoder specific options...
    //
    try {
      encoder.init();
    } catch ( PasswordEncoderException e ) {
      throw new KettleException( e );
    }
  }

View on GitHub (pinned to f3058517a1)