spring-projects/spring-security · error · IllegalArgumentException

String cannot be null

Error message

String cannot be null

What it means

Utf8.encode converts a CharSequence to UTF-8 bytes but explicitly rejects null input with an IllegalArgumentException. The charset encoder itself cannot be handed a null sequence, so the library checks up front and fails with a clear message.

Source

Thrown at crypto/src/main/java/org/springframework/security/crypto/codec/Utf8.java:47

 * UTF-8 Charset encoder/decoder.
 * <p>
 * For internal use only.
 *
 * @author Luke Taylor
 */
public final class Utf8 {

	private static final Charset CHARSET = StandardCharsets.UTF_8;

	private Utf8() {
	}

	/**
	 * Get the bytes of the String in UTF-8 encoded form.
	 */
	public static byte[] encode(CharSequence string) {
		if (string == null) {
			throw new IllegalArgumentException("String cannot be null");
		}
		try {
			ByteBuffer bytes = CHARSET.newEncoder().encode(CharBuffer.wrap(string));
			byte[] bytesCopy = new byte[bytes.limit()];
			System.arraycopy(bytes.array(), 0, bytesCopy, 0, bytes.limit());
			return bytesCopy;
		}
		catch (CharacterCodingException ex) {
			throw new IllegalArgumentException("Encoding failed", ex);
		}
	}

	/**
	 * Decode the bytes in UTF-8 form into a String.
	 */
	public static String decode(byte[] bytes) {
		try {
			return CHARSET.newDecoder().decode(ByteBuffer.wrap(bytes)).toString();

View on GitHub (pinned to 96852e8860)

Solutions

1. Ensure the input CharSequence is non-null before calling encode.
2. Decide the null semantics: return empty bytes or skip encoding when input is null.
3. Throw your own descriptive exception or use Objects.requireNonNull with a message at the call site.

Example fix

// before
byte[] bytes = Utf8.encode(config.getPassword()); // NPE-adjacent throw if null
// after
String pwd = config.getPassword();
byte[] bytes = (pwd == null) ? new byte[0] : Utf8.encode(pwd);

if (input == null) throw new IllegalArgumentException("cannot encode null string");
byte[] bytes = Utf8.encode(input);

boolean isNonNull(CharSequence s) { return s != null; }

try { bytes = Utf8.encode(s); } catch (IllegalArgumentException e) { bytes = new byte[0]; /* or rethrow with context */ }

When it happens

Trigger: Calling Utf8.encode(null), commonly when the argument originates from an optional request parameter, a nullable DB column, or a config value that is absent.

Common situations: Encoding a password/secret field that is null because a property wasn't set; passing the result of map.get("key") without a null check; NPE-avoidance refactors that route nulls here.

Related errors

• Hex-encoded string must have an even number of characters
• Detected a Non-hex character at N or N+1 position
• Encoding failed
• Decoding failed
• idForEncode cannot be null

AI-assisted analysis of spring-projects/spring-security@96852e8860 (2026-09-10). Data as JSON: /api/errors/6763c779f2f3fce7. Report an issue: GitHub.