spring-projects/spring-security · error · IllegalStateException

No such hashing algorithm

Error message

No such hashing algorithm

What it means

Digester.createDigest wraps MessageDigest.getInstance and converts the checked NoSuchAlgorithmException into an IllegalStateException with this message. It means the JVM's security providers cannot supply an implementation of the requested hashing algorithm (e.g. "SHA-256"), so hashing cannot proceed. In practice this almost only happens when the algorithm string is misspelled or the JDK lacks a provider for an exotic algorithm.

Source

Thrown at crypto/src/main/java/org/springframework/security/crypto/password/Digester.java:69

		for (int i = 0; i < this.iterations; i++) {
			value = messageDigest.digest(value);
		}
		return value;
	}

	void setIterations(int iterations) {
		if (iterations <= 0) {
			throw new IllegalArgumentException("Iterations value must be greater than zero");
		}
		this.iterations = iterations;
	}

	private static MessageDigest createDigest(String algorithm) {
		try {
			return MessageDigest.getInstance(algorithm);
		}
		catch (NoSuchAlgorithmException ex) {
			throw new IllegalStateException("No such hashing algorithm", ex);
		}
	}

}

View on GitHub (pinned to 96852e8860)

Solutions

1. Use an exact standard algorithm name supported by every modern JDK: "MD5", "SHA-1", or "SHA-256".
2. Print available algorithms via java.security.Security.getAlgorithms("MessageDigest") and pick one that is listed.
3. If a newer algorithm is required (e.g. SHA-3), upgrade to a JDK/provider that supports it or register a provider such as BouncyCastle.

Example fix

// before
Digester digester = new Digester("sha256");
// after
Digester digester = new Digester("SHA-256");

boolean ok = java.security.Security.getAlgorithms("MessageDigest").contains("SHA-256");
if (!ok) throw new IllegalStateException("SHA-256 unavailable in this JVM");
Digester d = new Digester("SHA-256");

try {
    new Digester(algorithm);
} catch (IllegalStateException e) {
    // fall back to "SHA-256" and log the unsupported algorithm
}

When it happens

Trigger: Constructing Digester with an algorithm name no installed security provider supports, e.g. new Digester("SHA3-256") on an old JDK, or a typo like new Digester("sha256") where the provider rejects the exact name.

Common situations: Hard-coding an algorithm string from documentation for a different JDK version; running on a stripped-down JRE or FIPS-restricted environment missing standard providers; passing a non-standard algorithm name from configuration.

Understand the failure class

Background: UnsupportedOperationException and "is not supported" errors: when a library deliberately refuses a call — this error's family across 30 libraries.

Related errors

• No SHA implementation available!
• Iterations value must be greater than zero
• Invalid algorithm '{algorithmName}'.
• Could not create hash
• Failed find SHA1PRNG algorithm!

AI-assisted analysis of spring-projects/spring-security@96852e8860 (2026-09-10). Data as JSON: /api/errors/43646b0d46a4c060. Report an issue: GitHub.