spring-projects/spring-security · error · IllegalArgumentException

idForEncode {idForEncode}is not found in idToPasswordEncoder

Error message

idForEncode {idForEncode}is not found in idToPasswordEncoder {idToPasswordEncoder}

What it means

DelegatingPasswordEncoder encodes with the delegate registered under idForEncode. If that id is absent from the supplied idToPasswordEncoder map, no encoder can be selected and the constructor throws this IllegalArgumentException. Note the message text has a missing space after the id (a known message quirk).

Source

Thrown at crypto/src/main/java/org/springframework/security/crypto/password/DelegatingPasswordEncoder.java:193

	 * {@link #matches(CharSequence, String)}
	 */
	public DelegatingPasswordEncoder(String idForEncode, Map<String, PasswordEncoder> idToPasswordEncoder,
			String idPrefix, String idSuffix) {
		if (idForEncode == null) {
			throw new IllegalArgumentException("idForEncode cannot be null");
		}
		if (idPrefix == null) {
			throw new IllegalArgumentException("prefix cannot be null");
		}
		if (idSuffix == null || idSuffix.isEmpty()) {
			throw new IllegalArgumentException("suffix cannot be empty");
		}
		if (idPrefix.contains(idSuffix)) {
			throw new IllegalArgumentException("idPrefix " + idPrefix + " cannot contain idSuffix " + idSuffix);
		}

		if (!idToPasswordEncoder.containsKey(idForEncode)) {
			throw new IllegalArgumentException(
					"idForEncode " + idForEncode + "is not found in idToPasswordEncoder " + idToPasswordEncoder);
		}
		for (String id : idToPasswordEncoder.keySet()) {
			if (id == null) {
				continue;
			}
			if (!idPrefix.isEmpty() && id.contains(idPrefix)) {
				throw new IllegalArgumentException("id " + id + " cannot contain " + idPrefix);
			}
			if (id.contains(idSuffix)) {
				throw new IllegalArgumentException("id " + id + " cannot contain " + idSuffix);
			}
		}
		this.idForEncode = idForEncode;
		this.passwordEncoderForEncode = idToPasswordEncoder.get(idForEncode);
		this.idToPasswordEncoder = new HashMap<>(idToPasswordEncoder);
		this.idPrefix = idPrefix;
		this.idSuffix = idSuffix;

View on GitHub (pinned to 96852e8860)

Solutions

1. Make idForEncode exactly match one of the keys of idToPasswordEncoder (case-sensitive)
2. Print the map keySet and the idForEncode value before construction to compare them
3. Ensure the encoder you want as default is unconditionally put into the map before creating the DelegatingPasswordEncoder
4. Use PasswordEncoderFactories.createDelegatingPasswordEncoder() which wires a valid default (bcrypt) for you

Example fix

// before
Map<String, PasswordEncoder> encoders = Map.of("pbkdf2", new Pbkdf2PasswordEncoder());
new DelegatingPasswordEncoder("bcrypt", encoders, "{", "}");
// after
Map<String, PasswordEncoder> encoders = new HashMap<>();
encoders.put("bcrypt", new BCryptPasswordEncoder());
new DelegatingPasswordEncoder("bcrypt", encoders, "{", "}");

if (!encoders.containsKey(idForEncode)) {
    throw new IllegalStateException("idForEncode '" + idForEncode + "' not in encoder keys: " + encoders.keySet());
}

try {
    return new DelegatingPasswordEncoder(idForEncode, encoders, "{", "}");
} catch (IllegalArgumentException e) {
    log.error("Encoder id '{}' not registered; available: {}", idForEncode, encoders.keySet());
    throw e;
}

When it happens

Trigger: Calling new DelegatingPasswordEncoder(idForEncode, idToPasswordEncoder, idPrefix, idSuffix) with an idForEncode key that is not present in the map, e.g. "bcrypt" when the map only has "pbkdf2".

Common situations: Renaming an encoder id in the map but not updating idForEncode; typos like "bycrypt"; building the encoder list conditionally so the default encoder is missing at construction time; upgrading Spring Security and assuming an id exists by default.

Understand the failure class

Background: 'Could not be found', 'does not exist', 'not found in database': the resource-not-found family when an ID, slug, key, or URI lookup comes back empty — this error's family across 20 libraries.

Related errors

• suffix cannot be empty
• idPrefix {idPrefix} cannot contain idSuffix {idSuffix}
• id {id} cannot contain {idPrefix}
• id {id} cannot contain {idSuffix}
• Unsupported implementation of Sid

AI-assisted analysis of spring-projects/spring-security@96852e8860 (2026-09-10). Data as JSON: /api/errors/35cf90fa36d4d68c. Report an issue: GitHub.