spring-projects/spring-security · error · IllegalArgumentException

Invalid algorithm '{algorithmName}'.

Error message

Invalid algorithm '{algorithmName}'.

What it means

setAlgorithm validates the chosen algorithm by attempting SecretKeyFactory.getInstance(algorithmName); if no provider supplies it, this IllegalArgumentException("Invalid algorithm '<name>'.") is thrown. It means the JVM cannot create a SecretKeyFactory for the requested PBKDF2 variant — typically because the JDK is too old (PBKDF2WithHmacSHA256/512 need Java 8u+/9+) or a restricted provider set is installed.

Source

Thrown at crypto/src/main/java/org/springframework/security/crypto/password/Pbkdf2PasswordEncoder.java:178

	 * "https://docs.oracle.com/javase/8/docs/technotes/guides/security/StandardNames.html#SecretKeyFactory">SecretKeyFactory
	 * Algorithms</a>
	 * @param secretKeyFactoryAlgorithm the algorithm to use (i.e.
	 * {@code SecretKeyFactoryAlgorithm.PBKDF2WithHmacSHA1},
	 * {@code SecretKeyFactoryAlgorithm.PBKDF2WithHmacSHA256},
	 * {@code SecretKeyFactoryAlgorithm.PBKDF2WithHmacSHA512})
	 * @since 5.0
	 */
	public void setAlgorithm(SecretKeyFactoryAlgorithm secretKeyFactoryAlgorithm) {
		if (secretKeyFactoryAlgorithm == null) {
			throw new IllegalArgumentException("secretKeyFactoryAlgorithm cannot be null");
		}
		String algorithmName = secretKeyFactoryAlgorithm.name();
		try {
			SecretKeyFactory.getInstance(algorithmName);
			this.algorithm = algorithmName;
		}
		catch (NoSuchAlgorithmException ex) {
			throw new IllegalArgumentException("Invalid algorithm '" + algorithmName + "'.", ex);
		}
		if (this.overrideHashWidth) {
			this.hashWidth = SecretKeyFactoryAlgorithm.PBKDF2WithHmacSHA1.equals(secretKeyFactoryAlgorithm) ? 160
					: SecretKeyFactoryAlgorithm.PBKDF2WithHmacSHA256.equals(secretKeyFactoryAlgorithm) ? 256 : 512;
		}
	}

	/**
	 * Sets if the resulting hash should be encoded as Base64. The default is false which
	 * means it will be encoded in Hex.
	 * @param encodeHashAsBase64 true if encode as Base64, false if should use Hex
	 * (default)
	 */
	public void setEncodeHashAsBase64(boolean encodeHashAsBase64) {
		this.encodeHashAsBase64 = encodeHashAsBase64;
	}

	@Override

View on GitHub (pinned to 96852e8860)

Solutions

1. Upgrade to a JDK that supports the algorithm (Oracle/OpenJDK 8u+ or 11+ for SHA-256/SHA-512 PBKDF2).
2. Fall back to SecretKeyFactoryAlgorithm.PBKDF2WithHmacSHA1, which is universally available, if the runtime cannot be upgraded.
3. Register a provider (e.g. BouncyCastle) that supplies the missing SecretKeyFactory transformation.

Example fix

// before
encoder.setAlgorithm(SecretKeyFactoryAlgorithm.PBKDF2WithHmacSHA512); // Java 7
// after
encoder.setAlgorithm(SecretKeyFactoryAlgorithm.PBKDF2WithHmacSHA1); // works everywhere

String name = algo.name();
boolean available = java.security.Security.getAlgorithms("SecretKeyFactory").contains(name);
if (!available) algo = SecretKeyFactoryAlgorithm.PBKDF2WithHmacSHA1;
encoder.setAlgorithm(algo);

try {
    encoder.setAlgorithm(SecretKeyFactoryAlgorithm.PBKDF2WithHmacSHA512);
} catch (IllegalArgumentException e) {
    encoder.setAlgorithm(SecretKeyFactoryAlgorithm.PBKDF2WithHmacSHA1); // universal fallback
}

When it happens

Trigger: Calling setAlgorithm(SecretKeyFactoryAlgorithm.PBKDF2WithHmacSHA256) or PBKDF2WithHmacSHA512 on a JDK whose providers lack those transformations (older Java 7/early 8, or FIPS-limited providers).

Common situations: Deploying to an older JVM after developing on a modern JDK; vendor JREs or FIPS configurations that only expose PBKDF2WithHmacSHA1; misconfigured java.security provider list.

Understand the failure class

Background: "Must be a positive integer", "Invalid value", "Unsupported": the invalid-argument-value error family, when a library rejects the value you pass — this error's family across 35 libraries.

Related errors

• No such hashing algorithm
• No SHA implementation available!
• secretKeyFactoryAlgorithm cannot be null
• Could not create hash
• Failed find SHA1PRNG algorithm!

AI-assisted analysis of spring-projects/spring-security@96852e8860 (2026-09-10). Data as JSON: /api/errors/907fe080ace32844. Report an issue: GitHub.