spring-projects/spring-security · error · IllegalStateException

Could not create hash

Error message

Could not create hash

What it means

encodedNonNullPassword builds the PBEKeySpec and derives the hash via SecretKeyFactory; any GeneralSecurityException raised there is wrapped in this IllegalStateException("Could not create hash"). Since the algorithm was already validated in setAlgorithm, this signals an unexpected runtime crypto failure (provider removed mid-flight, invalid key spec, etc.) rather than normal user error.

Source

Thrown at crypto/src/main/java/org/springframework/security/crypto/password/Pbkdf2PasswordEncoder.java:232

		return MessageDigest.isEqual(digested, encodedNonNullPassword(rawPassword, salt));
	}

	private byte[] decode(String encodedBytes) {
		if (this.encodeHashAsBase64) {
			return Base64.getDecoder().decode(encodedBytes);
		}
		return Hex.decode(encodedBytes);
	}

	private byte[] encodedNonNullPassword(CharSequence rawPassword, byte[] salt) {
		try {
			PBEKeySpec spec = new PBEKeySpec(rawPassword.toString().toCharArray(),
					EncodingUtils.concatenate(salt, this.secret), this.iterations, this.hashWidth);
			SecretKeyFactory skf = SecretKeyFactory.getInstance(this.algorithm);
			return EncodingUtils.concatenate(salt, skf.generateSecret(spec).getEncoded());
		}
		catch (GeneralSecurityException ex) {
			throw new IllegalStateException("Could not create hash", ex);
		}
	}

	/**
	 * The Algorithm used for creating the {@link SecretKeyFactory}.
	 *
	 * @since 5.0
	 */
	public enum SecretKeyFactoryAlgorithm {

		PBKDF2WithHmacSHA1, PBKDF2WithHmacSHA256, PBKDF2WithHmacSHA512

	}

}

View on GitHub (pinned to 96852e8860)

Solutions

1. Inspect the wrapped cause (ex.getCause()) in the stack trace to find the underlying GeneralSecurityException.
2. Verify the JCA provider supplying the PBKDF2 algorithm is still installed (Security.getProviders()).
3. Keep algorithm/hashWidth within tested combinations — set the algorithm via setAlgorithm so it is validated up front, and avoid removing providers at runtime.

Example fix

// before (application code)
Security.removeProvider("SunJCE"); // breaks later PBKDF2 calls
// after
// leave default providers installed; only add providers, never remove

try {
    hash = encoder.encode(raw);
} catch (IllegalStateException e) {
    if (e.getMessage().equals("Could not create hash")) {
        log.error("PBKDF2 failure", e.getCause()); // inspect GeneralSecurityException cause
        throw e;
    }
}

When it happens

Trigger: Calling encode() or matches() when SecretKeyFactory.getInstance(this.algorithm) or skf.generateSecret(spec) fails at runtime — e.g. the provider backing the algorithm was deregistered, or hashWidth/iterations produce an invalid PBEKeySpec.

Common situations: Dynamic provider manipulation (Security.removeProvider) at runtime; exotic hashWidth values on restrictive providers; JVM security policy blocking the crypto operation.

Understand the failure class

Background: "This is a bug, please report it": internal invariant violations, unreachable panics, and SNH errors explained — this error's family across 47 libraries.

Related errors

• Iterations value must be greater than zero
• No such hashing algorithm
• No SHA implementation available!
• secretKeyFactoryAlgorithm cannot be null
• Invalid algorithm '{algorithmName}'.

AI-assisted analysis of spring-projects/spring-security@96852e8860 (2026-09-10). Data as JSON: /api/errors/a846cc152ff5fd81. Report an issue: GitHub.