spring-projects/spring-security · error · IllegalArgumentException

Amount of performance parameters invalid

Error message

Amount of performance parameters invalid

What it means

The performance-parameter segment of an Argon2 PHC hash must contain exactly three comma-separated components: m=<memory>, t=<iterations>, p=<parallelism>. If splitting that segment on ',' yields anything other than 3 items, decode() throws this IllegalArgumentException because the hash parameters cannot be reconstructed.

Source

Thrown at crypto/src/main/java/org/springframework/security/crypto/argon2/Argon2EncodingUtils.java:122

		Argon2Parameters.Builder paramsBuilder;
		String[] parts = encodedHash.split("\\$");
		if (parts.length < 4) {
			throw new IllegalArgumentException("Invalid encoded Argon2-hash");
		}
		int currentPart = 1;
		paramsBuilder = switch (parts[currentPart++]) {
			case "argon2d" -> new Argon2Parameters.Builder(Argon2Parameters.ARGON2_d);
			case "argon2i" -> new Argon2Parameters.Builder(Argon2Parameters.ARGON2_i);
			case "argon2id" -> new Argon2Parameters.Builder(Argon2Parameters.ARGON2_id);
			default -> throw new IllegalArgumentException("Invalid algorithm type: " + parts[1]);
		};
		if (parts[currentPart].startsWith("v=")) {
			paramsBuilder.withVersion(Integer.parseInt(parts[currentPart].substring(2)));
			currentPart++;
		}
		String[] performanceParams = parts[currentPart++].split(",");
		if (performanceParams.length != 3) {
			throw new IllegalArgumentException("Amount of performance parameters invalid");
		}
		if (!performanceParams[0].startsWith("m=")) {
			throw new IllegalArgumentException("Invalid memory parameter");
		}
		paramsBuilder.withMemoryAsKB(Integer.parseInt(performanceParams[0].substring(2)));
		if (!performanceParams[1].startsWith("t=")) {
			throw new IllegalArgumentException("Invalid iterations parameter");
		}
		paramsBuilder.withIterations(Integer.parseInt(performanceParams[1].substring(2)));
		if (!performanceParams[2].startsWith("p=")) {
			throw new IllegalArgumentException("Invalid parallelity parameter");
		}
		paramsBuilder.withParallelism(Integer.parseInt(performanceParams[2].substring(2)));
		paramsBuilder.withSalt(b64decoder.decode(parts[currentPart++]));
		return new Argon2Hash(b64decoder.decode(parts[currentPart]), paramsBuilder.build());
	}

	public static class Argon2Hash {

View on GitHub (pinned to 96852e8860)

Solutions

1. Regenerate the hash with Spring Security's Argon2PasswordEncoder or another spec-compliant Argon2 implementation
2. Inspect the hash string and confirm the third segment looks like 'm=65536,t=3,p=1'
3. Reject malformed hashes at the storage boundary and force a password reset for affected users

Example fix

// before
Argon2Hash h = Argon2EncodingUtils.decode("$argon2id$v=19$65536$salt$hash"); // params segment missing
// after
Argon2Hash h = Argon2EncodingUtils.decode("$argon2id$v=19$m=65536,t=3,p=1$c2FsdA$aGFzaA");

static boolean hasThreeParams(String encodedHash) {
    String[] parts = encodedHash.split("\\$");
    return parts.length >= 3 && parts[2].split(",").length == 3;
}

try {
    return Argon2EncodingUtils.decode(hash);
} catch (IllegalArgumentException e) {
    log.warn("Malformed Argon2 hash parameters");
    return null;
}

When it happens

Trigger: Calling decode() on a hash where the parameter segment lacks or has extra comma-separated fields — e.g. '$argon2id$v=19$65536$...' (missing t= and p=), or hand-edited hashes with an extra token.

Common situations: Hashes generated by non-conforming tools or libraries writing abbreviated parameters; manual truncation during debugging; copy/paste that dropped part of the string.

Understand the failure class

Background: "Invalid ... format", "must be in format X", "does not look like a ..." — invalid argument format errors across CLI tools and libraries — this error's family across 17 libraries.

Related errors

• Invalid encoded Argon2-hash
• Invalid memory parameter
• Invalid iterations parameter
• Invalid parallelity parameter
• Invalid algorithm type: X

AI-assisted analysis of spring-projects/spring-security@96852e8860 (2026-09-10). Data as JSON: /api/errors/3894f2a85e32e16a. Report an issue: GitHub.