spring-projects/spring-security · error · IllegalArgumentException

encode cannot be null

Error message

encode cannot be null

What it means

The Base64StringKeyGenerator(Base64.Encoder, int) constructor validates that the supplied Base64.Encoder is non-null and throws IllegalArgumentException('encode cannot be null') otherwise. The encoder determines how the random key bytes are rendered as a string, so a null encoder is an invalid construction argument.

Source

Thrown at crypto/src/main/java/org/springframework/security/crypto/keygen/Base64StringKeyGenerator.java:69

		this(Base64.getEncoder(), keyLength);
	}

	/**
	 * Creates an instance with keyLength of 32 bytes and the provided encoder.
	 * @param encoder the encoder to use
	 */
	public Base64StringKeyGenerator(Base64.Encoder encoder) {
		this(encoder, DEFAULT_KEY_LENGTH);
	}

	/**
	 * Creates an instance with the provided key length and encoder.
	 * @param encoder the encoder to use
	 * @param keyLength the key length to use
	 */
	public Base64StringKeyGenerator(Base64.Encoder encoder, int keyLength) {
		if (encoder == null) {
			throw new IllegalArgumentException("encode cannot be null");
		}
		if (keyLength <= 0) {
			throw new IllegalArgumentException("keyLength must be greater than 0");
		}
		this.encoder = encoder;
		this.keyGenerator = KeyGenerators.secureRandom(keyLength);
	}

	@Override
	public String generateKey() {
		byte[] key = this.keyGenerator.generateKey();
		byte[] base64EncodedKey = this.encoder.encode(key);
		return new String(base64EncodedKey);
	}

}

View on GitHub (pinned to 96852e8860)

Solutions

1. Pass a concrete encoder such as Base64.getEncoder(), Base64.getUrlEncoder(), or Base64.getMimeEncoder().
2. If the encoder is configurable, apply Objects.requireNonNullElse(encoder, Base64.getEncoder()) before constructing.
3. Use the no-arg or single-int constructors if URL-safe Base64 defaults are acceptable.

Example fix

// before
Base64.Encoder enc = config.isUrlSafe() ? Base64.getUrlEncoder() : null;
Base64StringKeyGenerator gen = new Base64StringKeyGenerator(enc, 32);
// after
Base64.Encoder enc = config.isUrlSafe() ? Base64.getUrlEncoder() : Base64.getEncoder();
Base64StringKeyGenerator gen = new Base64StringKeyGenerator(enc, 32);

if (encoder == null) {
    throw new IllegalArgumentException("encoder must be non-null: use Base64.getEncoder() or Base64.getUrlEncoder()");
}
Base64StringKeyGenerator gen = new Base64StringKeyGenerator(encoder, keyLength);

boolean isValidEncoder(java.util.Base64.Encoder e) { return e != null; }

try {
    generator = new Base64StringKeyGenerator(encoder, keyLength);
} catch (IllegalArgumentException ex) {
    generator = new Base64StringKeyGenerator(Base64.getEncoder(), keyLength); // safe default
}

When it happens

Trigger: Calling new Base64StringKeyGenerator(null, someLength) or passing an encoder variable that was never initialized (e.g. a conditional encoder expression that resolved to null).

Common situations: Building the encoder dynamically from config and forgetting a default; refactoring where Base64.getEncoder() call was dropped; DI/property binding yielding a null encoder object.

Related errors

• keyLength must be greater than 0
• idForEncode cannot be null
• prefix cannot be null
• Cannot pass null or empty values to constructor
• Invalid len

AI-assisted analysis of spring-projects/spring-security@96852e8860 (2026-09-10). Data as JSON: /api/errors/da8bd89e9359df6d. Report an issue: GitHub.