spring-projects/spring-security · error · IllegalArgumentException

Invalid parallelity parameter

Error message

Invalid parallelity parameter

What it means

The third performance parameter must start with 'p=' (parallelism/lane count). If performanceParams[2] does not, decode() throws this IllegalArgumentException. Parallelism is needed to fully rebuild Argon2Parameters; without it the hash cannot be verified.

Source

Thrown at crypto/src/main/java/org/springframework/security/crypto/argon2/Argon2EncodingUtils.java:133

		};
		if (parts[currentPart].startsWith("v=")) {
			paramsBuilder.withVersion(Integer.parseInt(parts[currentPart].substring(2)));
			currentPart++;
		}
		String[] performanceParams = parts[currentPart++].split(",");
		if (performanceParams.length != 3) {
			throw new IllegalArgumentException("Amount of performance parameters invalid");
		}
		if (!performanceParams[0].startsWith("m=")) {
			throw new IllegalArgumentException("Invalid memory parameter");
		}
		paramsBuilder.withMemoryAsKB(Integer.parseInt(performanceParams[0].substring(2)));
		if (!performanceParams[1].startsWith("t=")) {
			throw new IllegalArgumentException("Invalid iterations parameter");
		}
		paramsBuilder.withIterations(Integer.parseInt(performanceParams[1].substring(2)));
		if (!performanceParams[2].startsWith("p=")) {
			throw new IllegalArgumentException("Invalid parallelity parameter");
		}
		paramsBuilder.withParallelism(Integer.parseInt(performanceParams[2].substring(2)));
		paramsBuilder.withSalt(b64decoder.decode(parts[currentPart++]));
		return new Argon2Hash(b64decoder.decode(parts[currentPart]), paramsBuilder.build());
	}

	public static class Argon2Hash {

		private byte[] hash;

		private Argon2Parameters parameters;

		Argon2Hash(byte[] hash, Argon2Parameters parameters) {
			this.hash = Arrays.clone(hash);
			this.parameters = parameters;
		}

		public byte[] getHash() {

View on GitHub (pinned to 96852e8860)

Solutions

1. Complete the parameter segment to 'm=<kb>,t=<it>,p=<par>' with a valid parallelism value (typically 1)
2. Regenerate the hash with Argon2PasswordEncoder and update the stored value
3. Validate the full PHC pattern with a regex before calling decode()

Example fix

// before
String hash = "$argon2id$v=19$m=65536,t=3$salt$hash"; // p= missing
// after
String hash = "$argon2id$v=19$m=65536,t=3,p=1$salt$hash";

static boolean hasParallelismParam(String encodedHash) {
    String[] parts = encodedHash.split("\\$");
    return parts.length >= 3 && parts[2].matches("m=\\d+,t=\\d+,p=\\d+");
}

try {
    return Argon2EncodingUtils.decode(hash);
} catch (IllegalArgumentException e) {
    log.warn("Argon2 hash missing p= parallelism parameter");
    return false;
}

When it happens

Trigger: Calling decode() on a hash whose third comma-separated parameter lacks 'p=' — e.g. 'm=65536,t=3,1' or a truncated parameter segment ending at 't=3'.

Common situations: Truncated copy/paste of hash strings; custom encoders omitting the parallelism field; hashes migrated between systems with lossy string handling.

Understand the failure class

Background: "Invalid ... format", "must be in format X", "does not look like a ..." — invalid argument format errors across CLI tools and libraries — this error's family across 17 libraries.

Related errors

• Invalid encoded Argon2-hash
• Amount of performance parameters invalid
• Invalid memory parameter
• Invalid iterations parameter
• Invalid algorithm type: X

AI-assisted analysis of spring-projects/spring-security@96852e8860 (2026-09-10). Data as JSON: /api/errors/8a13c90352671003. Report an issue: GitHub.