spring-projects/spring-security · error · IllegalArgumentException

Invalid iterations parameter

Error message

Invalid iterations parameter

What it means

The second performance parameter must start with 't=' (iteration count). If performanceParams[1] does not, decode() throws this IllegalArgumentException. The iteration count is required to reconstruct the Argon2Parameters for verification.

Source

Thrown at crypto/src/main/java/org/springframework/security/crypto/argon2/Argon2EncodingUtils.java:129

			case "argon2d" -> new Argon2Parameters.Builder(Argon2Parameters.ARGON2_d);
			case "argon2i" -> new Argon2Parameters.Builder(Argon2Parameters.ARGON2_i);
			case "argon2id" -> new Argon2Parameters.Builder(Argon2Parameters.ARGON2_id);
			default -> throw new IllegalArgumentException("Invalid algorithm type: " + parts[1]);
		};
		if (parts[currentPart].startsWith("v=")) {
			paramsBuilder.withVersion(Integer.parseInt(parts[currentPart].substring(2)));
			currentPart++;
		}
		String[] performanceParams = parts[currentPart++].split(",");
		if (performanceParams.length != 3) {
			throw new IllegalArgumentException("Amount of performance parameters invalid");
		}
		if (!performanceParams[0].startsWith("m=")) {
			throw new IllegalArgumentException("Invalid memory parameter");
		}
		paramsBuilder.withMemoryAsKB(Integer.parseInt(performanceParams[0].substring(2)));
		if (!performanceParams[1].startsWith("t=")) {
			throw new IllegalArgumentException("Invalid iterations parameter");
		}
		paramsBuilder.withIterations(Integer.parseInt(performanceParams[1].substring(2)));
		if (!performanceParams[2].startsWith("p=")) {
			throw new IllegalArgumentException("Invalid parallelity parameter");
		}
		paramsBuilder.withParallelism(Integer.parseInt(performanceParams[2].substring(2)));
		paramsBuilder.withSalt(b64decoder.decode(parts[currentPart++]));
		return new Argon2Hash(b64decoder.decode(parts[currentPart]), paramsBuilder.build());
	}

	public static class Argon2Hash {

		private byte[] hash;

		private Argon2Parameters parameters;

		Argon2Hash(byte[] hash, Argon2Parameters parameters) {
			this.hash = Arrays.clone(hash);

View on GitHub (pinned to 96852e8860)

Solutions

1. Restore the canonical parameter form 'm=<kb>,t=<it>,p=<par>' in the hash string
2. Regenerate the hash with a spec-compliant encoder such as Argon2PasswordEncoder
3. Add a pre-decode regex validation to fail fast with a clearer message

Example fix

// before
String params = "m=65536,3,p=1";
// after
String params = "m=65536,t=3,p=1";

static boolean hasIterationsParam(String encodedHash) {
    String[] parts = encodedHash.split("\\$");
    return parts.length >= 3 && parts[2].matches(".*\\bt=\\d+.*");
}

try {
    return Argon2EncodingUtils.decode(hash);
} catch (IllegalArgumentException e) {
    log.warn("Argon2 hash missing t= iterations parameter");
    return false;
}

When it happens

Trigger: Calling decode() on a hash whose second comma-separated parameter lacks 't=' — e.g. 'm=65536,3,p=1' (missing the t= key) or fields out of order.

Common situations: Hashes from custom or buggy Argon2 encoders; hand-edited hashes where 't=' was deleted; format conversions between hash notations.

Understand the failure class

Background: "Invalid ... format", "must be in format X", "does not look like a ..." — invalid argument format errors across CLI tools and libraries — this error's family across 17 libraries.

Related errors

• Invalid encoded Argon2-hash
• Amount of performance parameters invalid
• Invalid memory parameter
• Invalid parallelity parameter
• Invalid algorithm type: X

AI-assisted analysis of spring-projects/spring-security@96852e8860 (2026-09-10). Data as JSON: /api/errors/b246f50a1561bc98. Report an issue: GitHub.