features-authentication-password-storage.html

<!DOCTYPE html>
<html lang="en-US">
  <head>
    <meta charset="utf-8">
    <meta name="viewport" content="width=device-width,initial-scale=1">
    <title>Password Storage | Spring Docs</title>
    <meta name="generator" content="VuePress 1.9.7">
    <link rel="icon" type="image/png" sizes="16x16" href="/images/icons/favicon.ico">
    <link rel="icon" type="image/png" sizes="48x48" href="/images/icons/icon-48x48.png">
    <link rel="icon" type="image/png" sizes="72x72" href="/images/icons/icon-72x72.png">
    <link rel="manifest" href="/manifest.webmanifest">
    <link rel="apple-touch-icon" href="/images/icons/icon_48x48.png">
    <link rel="mask-icon" href="/images/icons/favicon.ico" color="#5dac38">
    <script>
    var _hmt = _hmt || [];
    (function () {
      var hm = document.createElement("script");
      hm.src = "https://hm.baidu.com/hm.js?8eefd6b163dcb3f5762af6b0825e2dd1";
      var s = document.getElementsByTagName("script")[0];
      s.parentNode.insertBefore(hm, s);
    })();
    </script>
    <meta name="description" content="Spring Security’s PasswordEncoder interface is used to perform a one way transformation of a password to allow the password to be stored securely.
Given PasswordEncoder is a one way transformation, it is not intended when the password transformation needs to be two way (i.e. storing credentials used to authenticate to a database).
Typically PasswordEncoder is used for storing a password that needs to be compared to a user provided password at the time of authentication.">
    <meta name="twitter:title" content="Password Storage">
    <meta name="twitter:description" content="Spring Security’s PasswordEncoder interface is used to perform a one way transformation of a password to allow the password to be stored securely.
Given PasswordEncoder is a one way transformation, it is not intended when the password transformation needs to be two way (i.e. storing credentials used to authenticate to a database).
Typically PasswordEncoder is used for storing a password that needs to be compared to a user provided password at the time of authentication.">
    <meta name="twitter:card" content="summary">
    <meta name="twitter:url" content="https://spring.gitcode.net/en/spring-security/features-authentication-password-storage.html">
    <meta property="og:type" content="article">
    <meta property="og:title" content="Password Storage">
    <meta property="og:description" content="Spring Security’s PasswordEncoder interface is used to perform a one way transformation of a password to allow the password to be stored securely.
Given PasswordEncoder is a one way transformation, it is not intended when the password transformation needs to be two way (i.e. storing credentials used to authenticate to a database).
Typically PasswordEncoder is used for storing a password that needs to be compared to a user provided password at the time of authentication.">
    <meta property="og:url" content="https://spring.gitcode.net/en/spring-security/features-authentication-password-storage.html">
    <meta property="og:site_name" content="Spring 中文文档社区">
    <meta itemprop="name" content="Password Storage">
    <meta itemprop="description" content="Spring Security’s PasswordEncoder interface is used to perform a one way transformation of a password to allow the password to be stored securely.
Given PasswordEncoder is a one way transformation, it is not intended when the password transformation needs to be two way (i.e. storing credentials used to authenticate to a database).
Typically PasswordEncoder is used for storing a password that needs to be compared to a user provided password at the time of authentication.">
    <meta name="application-name" content="Spring 中文文档社区">
    <meta name="apple-mobile-web-app-title" content="Spring 中文社区">
    <meta name="apple-mobile-web-app-status-bar-style" content="black">
    <meta name="msapplication-TileColor" content="#5dac38">
    <meta name="theme-color" content="#5dac38">
    <meta name="viewport" content="width=device-width, initial-scale=1">
    <meta http-equiv="X-UA-Compatible" content="IE=edge">
    <meta name="baidu-site-verification" content="code-tApgxyb9G8">
    
    <link rel="preload" href="/assets/css/0.styles.28585500.css" as="style"><link rel="preload" href="/assets/js/app.91a38a71.js" as="script"><link rel="preload" href="/assets/js/3.50918073.js" as="script"><link rel="preload" href="/assets/js/4.cd4c3ff4.js" as="script"><link rel="preload" href="/assets/js/166.0e4c049b.js" as="script"><link rel="prefetch" href="/assets/js/10.675f4d7e.js"><link rel="prefetch" href="/assets/js/100.89ddf0f9.js"><link rel="prefetch" href="/assets/js/101.a2584c55.js"><link rel="prefetch" href="/assets/js/102.53225958.js"><link rel="prefetch" href="/assets/js/103.be06048d.js"><link rel="prefetch" href="/assets/js/104.a2328e06.js"><link rel="prefetch" href="/assets/js/105.75f4c207.js"><link rel="prefetch" href="/assets/js/106.fc779386.js"><link rel="prefetch" href="/assets/js/107.048638f4.js"><link rel="prefetch" href="/assets/js/108.18ecb5f7.js"><link rel="prefetch" href="/assets/js/109.22b51609.js"><link rel="prefetch" href="/assets/js/11.b58e279a.js"><link rel="prefetch" href="/assets/js/110.0e5bfcfe.js"><link rel="prefetch" href="/assets/js/111.62ba447b.js"><link rel="prefetch" href="/assets/js/112.3809d092.js"><link rel="prefetch" href="/assets/js/113.edbb458c.js"><link rel="prefetch" href="/assets/js/114.7e2b354f.js"><link rel="prefetch" href="/assets/js/115.4e41285c.js"><link rel="prefetch" href="/assets/js/116.faaa2083.js"><link rel="prefetch" href="/assets/js/117.4952cce2.js"><link rel="prefetch" href="/assets/js/118.306eabfa.js"><link rel="prefetch" href="/assets/js/119.7906e435.js"><link rel="prefetch" href="/assets/js/12.80bb4902.js"><link rel="prefetch" href="/assets/js/120.496c9660.js"><link rel="prefetch" href="/assets/js/121.e4a22135.js"><link rel="prefetch" href="/assets/js/122.06face15.js"><link rel="prefetch" href="/assets/js/123.190f461f.js"><link rel="prefetch" href="/assets/js/124.11d8be3e.js"><link rel="prefetch" href="/assets/js/125.d2296472.js"><link rel="prefetch" href="/assets/js/126.9cb2911c.js"><link rel="prefetch" href="/assets/js/127.870cadbf.js"><link rel="prefetch" href="/assets/js/128.456206df.js"><link rel="prefetch" href="/assets/js/129.ce51dc7d.js"><link rel="prefetch" href="/assets/js/13.29c1dc4b.js"><link rel="prefetch" href="/assets/js/130.89081f08.js"><link rel="prefetch" href="/assets/js/131.713226b7.js"><link rel="prefetch" href="/assets/js/132.6e2b68e3.js"><link rel="prefetch" href="/assets/js/133.2169bc8f.js"><link rel="prefetch" href="/assets/js/134.8de25763.js"><link rel="prefetch" href="/assets/js/135.961f6693.js"><link rel="prefetch" href="/assets/js/136.67bf4a6c.js"><link rel="prefetch" href="/assets/js/137.331bfb6b.js"><link rel="prefetch" href="/assets/js/138.f76ee7b9.js"><link rel="prefetch" href="/assets/js/139.578aa70e.js"><link rel="prefetch" href="/assets/js/14.1c437f54.js"><link rel="prefetch" href="/assets/js/140.9f1f28a0.js"><link rel="prefetch" href="/assets/js/141.b08ac1ec.js"><link rel="prefetch" href="/assets/js/142.e5c934cf.js"><link rel="prefetch" href="/assets/js/143.fdf42ebd.js"><link rel="prefetch" href="/assets/js/144.ad496c5f.js"><link rel="prefetch" href="/assets/js/145.5cf8f99c.js"><link rel="prefetch" href="/assets/js/146.979b34c1.js"><link rel="prefetch" href="/assets/js/147.46e366af.js"><link rel="prefetch" href="/assets/js/148.efcd2b17.js"><link rel="prefetch" href="/assets/js/149.52fc1f3e.js"><link rel="prefetch" href="/assets/js/15.cbd21f6a.js"><link rel="prefetch" href="/assets/js/150.679d76bf.js"><link rel="prefetch" href="/assets/js/151.2b0748da.js"><link rel="prefetch" href="/assets/js/152.2a21e665.js"><link rel="prefetch" href="/assets/js/153.571ff4a7.js"><link rel="prefetch" href="/assets/js/154.d89cac86.js"><link rel="prefetch" href="/assets/js/155.35a3e5ab.js"><link rel="prefetch" href="/assets/js/156.27654cff.js"><link rel="prefetch" href="/assets/js/157.036f4ba2.js"><link rel="prefetch" href="/assets/js/158.3767bc38.js"><link rel="prefetch" href="/assets/js/159.3fc08b95.js"><link rel="prefetch" href="/assets/js/16.0cc4679e.js"><link rel="prefetch" href="/assets/js/160.9c73e6f0.js"><link rel="prefetch" href="/assets/js/161.5707040f.js"><link rel="prefetch" href="/assets/js/162.f7bd796e.js"><link rel="prefetch" href="/assets/js/163.c7fd0b0f.js"><link rel="prefetch" href="/assets/js/164.117eb7b8.js"><link rel="prefetch" href="/assets/js/165.4fabe2ea.js"><link rel="prefetch" href="/assets/js/167.c8a74627.js"><link rel="prefetch" href="/assets/js/168.e16111b9.js"><link rel="prefetch" href="/assets/js/169.34048f7e.js"><link rel="prefetch" href="/assets/js/17.d3f5977b.js"><link rel="prefetch" href="/assets/js/170.4b38adcf.js"><link rel="prefetch" href="/assets/js/171.e57611aa.js"><link rel="prefetch" href="/assets/js/172.9ca2eb1a.js"><link rel="prefetch" href="/assets/js/173.0b5757a5.js"><link rel="prefetch" href="/assets/js/174.88d987b1.js"><link rel="prefetch" href="/assets/js/175.5989a4ca.js"><link rel="prefetch" href="/assets/js/176.ec96435a.js"><link rel="prefetch" href="/assets/js/177.ccf0210e.js"><link rel="prefetch" href="/assets/js/178.f1f78ad5.js"><link rel="prefetch" href="/assets/js/179.a1faadfe.js"><link rel="prefetch" href="/assets/js/18.1a2bbade.js"><link rel="prefetch" href="/assets/js/180.06a789e3.js"><link rel="prefetch" href="/assets/js/181.ed535589.js"><link rel="prefetch" href="/assets/js/182.2ea92f58.js"><link rel="prefetch" href="/assets/js/183.ae7d9259.js"><link rel="prefetch" href="/assets/js/184.8a38d25a.js"><link rel="prefetch" href="/assets/js/185.567bf0f2.js"><link rel="prefetch" href="/assets/js/186.cc535cf2.js"><link rel="prefetch" href="/assets/js/187.cf4186a5.js"><link rel="prefetch" href="/assets/js/188.467e5fb9.js"><link rel="prefetch" href="/assets/js/189.f4e7f8b2.js"><link rel="prefetch" href="/assets/js/19.ac0e9ed7.js"><link rel="prefetch" href="/assets/js/190.2edbc13e.js"><link rel="prefetch" href="/assets/js/191.744a6848.js"><link rel="prefetch" href="/assets/js/192.1bb07327.js"><link rel="prefetch" href="/assets/js/193.12702071.js"><link rel="prefetch" href="/assets/js/194.15f508e4.js"><link rel="prefetch" href="/assets/js/195.48066006.js"><link rel="prefetch" href="/assets/js/196.4eb490b2.js"><link rel="prefetch" href="/assets/js/197.2cffa063.js"><link rel="prefetch" href="/assets/js/198.e1f0f30b.js"><link rel="prefetch" href="/assets/js/199.5ae111e3.js"><link rel="prefetch" href="/assets/js/20.6c49f026.js"><link rel="prefetch" href="/assets/js/200.5bc674db.js"><link rel="prefetch" href="/assets/js/201.83f9975c.js"><link rel="prefetch" href="/assets/js/202.6a3d7100.js"><link rel="prefetch" href="/assets/js/203.03b6a860.js"><link rel="prefetch" href="/assets/js/204.2db6ba93.js"><link rel="prefetch" href="/assets/js/205.e992b689.js"><link rel="prefetch" href="/assets/js/206.eed8bd42.js"><link rel="prefetch" href="/assets/js/207.92f36aa6.js"><link rel="prefetch" href="/assets/js/208.cd63fa84.js"><link rel="prefetch" href="/assets/js/209.ed9ab8d5.js"><link rel="prefetch" href="/assets/js/21.c20a26ea.js"><link rel="prefetch" href="/assets/js/210.5414f9c2.js"><link rel="prefetch" href="/assets/js/211.94056191.js"><link rel="prefetch" href="/assets/js/212.cfe0a9c3.js"><link rel="prefetch" href="/assets/js/213.3d4abd6e.js"><link rel="prefetch" href="/assets/js/214.e62f8fc5.js"><link rel="prefetch" href="/assets/js/215.433d7113.js"><link rel="prefetch" href="/assets/js/216.ccd1636c.js"><link rel="prefetch" href="/assets/js/217.aeb050b9.js"><link rel="prefetch" href="/assets/js/218.f87af308.js"><link rel="prefetch" href="/assets/js/219.973cfb27.js"><link rel="prefetch" href="/assets/js/22.3563c6e0.js"><link rel="prefetch" href="/assets/js/220.ad665f16.js"><link rel="prefetch" href="/assets/js/221.86c2c9e4.js"><link rel="prefetch" href="/assets/js/222.681ce63b.js"><link rel="prefetch" href="/assets/js/223.dc353c8a.js"><link rel="prefetch" href="/assets/js/224.b9ba4b79.js"><link rel="prefetch" href="/assets/js/225.b9062e20.js"><link rel="prefetch" href="/assets/js/226.58e1fd73.js"><link rel="prefetch" href="/assets/js/227.f44065ae.js"><link rel="prefetch" href="/assets/js/228.26c6c72e.js"><link rel="prefetch" href="/assets/js/229.cddec42f.js"><link rel="prefetch" href="/assets/js/23.f9be176e.js"><link rel="prefetch" href="/assets/js/230.53093373.js"><link rel="prefetch" href="/assets/js/231.880d1b20.js"><link rel="prefetch" href="/assets/js/232.60e4df0d.js"><link rel="prefetch" href="/assets/js/233.36843a48.js"><link rel="prefetch" href="/assets/js/234.1e3e41c7.js"><link rel="prefetch" href="/assets/js/235.e154d363.js"><link rel="prefetch" href="/assets/js/236.bb6fd980.js"><link rel="prefetch" href="/assets/js/237.e7379a75.js"><link rel="prefetch" href="/assets/js/238.3012b35c.js"><link rel="prefetch" href="/assets/js/239.4db4e274.js"><link rel="prefetch" href="/assets/js/24.dd3c04e2.js"><link rel="prefetch" href="/assets/js/240.53e11bb4.js"><link rel="prefetch" href="/assets/js/241.6539a7f9.js"><link rel="prefetch" href="/assets/js/242.2c338449.js"><link rel="prefetch" href="/assets/js/243.b7dce054.js"><link rel="prefetch" href="/assets/js/244.1e3de76d.js"><link rel="prefetch" href="/assets/js/245.001df63f.js"><link rel="prefetch" href="/assets/js/246.48cb97a1.js"><link rel="prefetch" href="/assets/js/247.fa21e7f8.js"><link rel="prefetch" href="/assets/js/248.0dd9b346.js"><link rel="prefetch" href="/assets/js/249.3628bb8f.js"><link rel="prefetch" href="/assets/js/25.ef18cc01.js"><link rel="prefetch" href="/assets/js/250.01fbf76b.js"><link rel="prefetch" href="/assets/js/251.13231102.js"><link rel="prefetch" href="/assets/js/252.0449aade.js"><link rel="prefetch" href="/assets/js/253.a627a1a7.js"><link rel="prefetch" href="/assets/js/254.2493e550.js"><link rel="prefetch" href="/assets/js/255.ac6d41ee.js"><link rel="prefetch" href="/assets/js/256.e611c6b5.js"><link rel="prefetch" href="/assets/js/257.0c9230da.js"><link rel="prefetch" href="/assets/js/258.11cdfae1.js"><link rel="prefetch" href="/assets/js/259.87ba5ef3.js"><link rel="prefetch" href="/assets/js/26.5baa4d2c.js"><link rel="prefetch" href="/assets/js/260.6ee26736.js"><link rel="prefetch" href="/assets/js/261.17972d97.js"><link rel="prefetch" href="/assets/js/262.fabdb15a.js"><link rel="prefetch" href="/assets/js/263.49116ba6.js"><link rel="prefetch" href="/assets/js/264.75cb0c8e.js"><link rel="prefetch" href="/assets/js/265.73430472.js"><link rel="prefetch" href="/assets/js/266.6fd856ec.js"><link rel="prefetch" href="/assets/js/267.67165e17.js"><link rel="prefetch" href="/assets/js/268.cddc62ae.js"><link rel="prefetch" href="/assets/js/269.452ff2d4.js"><link rel="prefetch" href="/assets/js/27.2a2950d8.js"><link rel="prefetch" href="/assets/js/270.a5c429cb.js"><link rel="prefetch" href="/assets/js/271.ce6c21b2.js"><link rel="prefetch" href="/assets/js/272.32934d2b.js"><link rel="prefetch" href="/assets/js/273.2e2c7a19.js"><link rel="prefetch" href="/assets/js/274.6c51e7ae.js"><link rel="prefetch" href="/assets/js/275.24ef01b4.js"><link rel="prefetch" href="/assets/js/276.afeb2acd.js"><link rel="prefetch" href="/assets/js/277.6472c22d.js"><link rel="prefetch" href="/assets/js/278.416d9788.js"><link rel="prefetch" href="/assets/js/279.c190fbc9.js"><link rel="prefetch" href="/assets/js/28.6320d8c1.js"><link rel="prefetch" href="/assets/js/280.28b1b955.js"><link rel="prefetch" href="/assets/js/281.77afd7c5.js"><link rel="prefetch" href="/assets/js/282.c18960ec.js"><link rel="prefetch" href="/assets/js/283.e59fb0e5.js"><link rel="prefetch" href="/assets/js/284.9c6ff275.js"><link rel="prefetch" href="/assets/js/285.b9b17c42.js"><link rel="prefetch" href="/assets/js/286.c7d13ad0.js"><link rel="prefetch" href="/assets/js/287.7cfea342.js"><link rel="prefetch" href="/assets/js/288.f9448d7d.js"><link rel="prefetch" href="/assets/js/289.30726f95.js"><link rel="prefetch" href="/assets/js/29.a420635f.js"><link rel="prefetch" href="/assets/js/290.f79765e2.js"><link rel="prefetch" href="/assets/js/291.0943618c.js"><link rel="prefetch" href="/assets/js/292.bd04f6db.js"><link rel="prefetch" href="/assets/js/293.dfda3b2b.js"><link rel="prefetch" href="/assets/js/294.0a2e9d23.js"><link rel="prefetch" href="/assets/js/295.bd033d69.js"><link rel="prefetch" href="/assets/js/296.1090c539.js"><link rel="prefetch" href="/assets/js/297.ec37f6e8.js"><link rel="prefetch" href="/assets/js/298.fa434214.js"><link rel="prefetch" href="/assets/js/299.50bd7c87.js"><link rel="prefetch" href="/assets/js/30.6c81ca7b.js"><link rel="prefetch" href="/assets/js/300.7a2c6632.js"><link rel="prefetch" href="/assets/js/301.4ae4e645.js"><link rel="prefetch" href="/assets/js/302.e1ef7459.js"><link rel="prefetch" href="/assets/js/303.3894068b.js"><link rel="prefetch" href="/assets/js/304.840b09e3.js"><link rel="prefetch" href="/assets/js/305.40ec0bf6.js"><link rel="prefetch" href="/assets/js/306.9fa4d8aa.js"><link rel="prefetch" href="/assets/js/307.33656e76.js"><link rel="prefetch" href="/assets/js/308.19398f71.js"><link rel="prefetch" href="/assets/js/309.bde6f12f.js"><link rel="prefetch" href="/assets/js/31.2b4f2752.js"><link rel="prefetch" href="/assets/js/310.69ced632.js"><link rel="prefetch" href="/assets/js/311.c8e57d0e.js"><link rel="prefetch" href="/assets/js/312.80c4d6a7.js"><link rel="prefetch" href="/assets/js/313.14060a06.js"><link rel="prefetch" href="/assets/js/314.29165d83.js"><link rel="prefetch" href="/assets/js/315.901aabf1.js"><link rel="prefetch" href="/assets/js/316.d7cb5f30.js"><link rel="prefetch" href="/assets/js/317.15e26404.js"><link rel="prefetch" href="/assets/js/318.85760eca.js"><link rel="prefetch" href="/assets/js/319.1e2eac08.js"><link rel="prefetch" href="/assets/js/32.9cc2a24d.js"><link rel="prefetch" href="/assets/js/320.db086fc7.js"><link rel="prefetch" href="/assets/js/321.69316136.js"><link rel="prefetch" href="/assets/js/322.f93bbdab.js"><link rel="prefetch" href="/assets/js/323.2d67bb75.js"><link rel="prefetch" href="/assets/js/324.c41411db.js"><link rel="prefetch" href="/assets/js/325.a412ca77.js"><link rel="prefetch" href="/assets/js/326.0c247660.js"><link rel="prefetch" href="/assets/js/327.33524443.js"><link rel="prefetch" href="/assets/js/328.cee651db.js"><link rel="prefetch" href="/assets/js/329.9350c363.js"><link rel="prefetch" href="/assets/js/33.705bd0bb.js"><link rel="prefetch" href="/assets/js/330.d01a7e1b.js"><link rel="prefetch" href="/assets/js/331.a3ad2556.js"><link rel="prefetch" href="/assets/js/332.36ad912a.js"><link rel="prefetch" href="/assets/js/333.da27d2cc.js"><link rel="prefetch" href="/assets/js/334.492f9eeb.js"><link rel="prefetch" href="/assets/js/335.072780a2.js"><link rel="prefetch" href="/assets/js/336.454d4374.js"><link rel="prefetch" href="/assets/js/337.dba45eb4.js"><link rel="prefetch" href="/assets/js/338.d2bd2200.js"><link rel="prefetch" href="/assets/js/339.ae85118e.js"><link rel="prefetch" href="/assets/js/34.fa55416d.js"><link rel="prefetch" href="/assets/js/340.7033b85b.js"><link rel="prefetch" href="/assets/js/341.13cfe1aa.js"><link rel="prefetch" href="/assets/js/342.b33302b5.js"><link rel="prefetch" href="/assets/js/343.abd9aba4.js"><link rel="prefetch" href="/assets/js/344.e76aec56.js"><link rel="prefetch" href="/assets/js/345.12433fa3.js"><link rel="prefetch" href="/assets/js/346.b1bdfeba.js"><link rel="prefetch" href="/assets/js/347.53530bff.js"><link rel="prefetch" href="/assets/js/348.66b34aa5.js"><link rel="prefetch" href="/assets/js/349.fbe41e5a.js"><link rel="prefetch" href="/assets/js/35.f4845e0e.js"><link rel="prefetch" href="/assets/js/350.e4b2d6e6.js"><link rel="prefetch" href="/assets/js/351.37aef638.js"><link rel="prefetch" href="/assets/js/352.48b74301.js"><link rel="prefetch" href="/assets/js/353.7fd27c0f.js"><link rel="prefetch" href="/assets/js/354.74ffb3f7.js"><link rel="prefetch" href="/assets/js/355.adb94180.js"><link rel="prefetch" href="/assets/js/356.469ce73f.js"><link rel="prefetch" href="/assets/js/357.f0b7b800.js"><link rel="prefetch" href="/assets/js/358.2a4a9f53.js"><link rel="prefetch" href="/assets/js/359.648aa4f0.js"><link rel="prefetch" href="/assets/js/36.bdebdf29.js"><link rel="prefetch" href="/assets/js/360.05b28f6e.js"><link rel="prefetch" href="/assets/js/361.8c5225b8.js"><link rel="prefetch" href="/assets/js/362.ac0b6ff9.js"><link rel="prefetch" href="/assets/js/363.167f2042.js"><link rel="prefetch" href="/assets/js/364.5940b069.js"><link rel="prefetch" href="/assets/js/365.e429c365.js"><link rel="prefetch" href="/assets/js/366.cc650df8.js"><link rel="prefetch" href="/assets/js/367.347592c9.js"><link rel="prefetch" href="/assets/js/368.d68ce88d.js"><link rel="prefetch" href="/assets/js/369.034e7f1e.js"><link rel="prefetch" href="/assets/js/37.9d026956.js"><link rel="prefetch" href="/assets/js/370.ac6fc7a5.js"><link rel="prefetch" href="/assets/js/371.e70219a6.js"><link rel="prefetch" href="/assets/js/372.c449fc49.js"><link rel="prefetch" href="/assets/js/373.03ff7b1f.js"><link rel="prefetch" href="/assets/js/374.8152408f.js"><link rel="prefetch" href="/assets/js/375.63c70dab.js"><link rel="prefetch" href="/assets/js/376.06de19db.js"><link rel="prefetch" href="/assets/js/377.968e1f62.js"><link rel="prefetch" href="/assets/js/378.d9341c42.js"><link rel="prefetch" href="/assets/js/379.54a13769.js"><link rel="prefetch" href="/assets/js/38.23e83578.js"><link rel="prefetch" href="/assets/js/380.dac4cd46.js"><link rel="prefetch" href="/assets/js/381.8f83d1d7.js"><link rel="prefetch" href="/assets/js/382.e76e7d88.js"><link rel="prefetch" href="/assets/js/383.84a2cb0e.js"><link rel="prefetch" href="/assets/js/384.5093369e.js"><link rel="prefetch" href="/assets/js/385.ee576341.js"><link rel="prefetch" href="/assets/js/386.087a29a9.js"><link rel="prefetch" href="/assets/js/387.94e3e82f.js"><link rel="prefetch" href="/assets/js/388.db594336.js"><link rel="prefetch" href="/assets/js/389.f5396ffc.js"><link rel="prefetch" href="/assets/js/39.e9699d7f.js"><link rel="prefetch" href="/assets/js/390.c377efca.js"><link rel="prefetch" href="/assets/js/391.d7747385.js"><link rel="prefetch" href="/assets/js/392.bf8e8c1a.js"><link rel="prefetch" href="/assets/js/393.b4ed3be0.js"><link rel="prefetch" href="/assets/js/394.48eb505a.js"><link rel="prefetch" href="/assets/js/395.db803949.js"><link rel="prefetch" href="/assets/js/396.f8674e1b.js"><link rel="prefetch" href="/assets/js/397.d19960fa.js"><link rel="prefetch" href="/assets/js/398.15f66e2a.js"><link rel="prefetch" href="/assets/js/399.3bc82adc.js"><link rel="prefetch" href="/assets/js/40.3a541653.js"><link rel="prefetch" href="/assets/js/400.d99e4b93.js"><link rel="prefetch" href="/assets/js/401.13fa06dd.js"><link rel="prefetch" href="/assets/js/402.229d6801.js"><link rel="prefetch" href="/assets/js/403.5826b040.js"><link rel="prefetch" href="/assets/js/404.d4b35549.js"><link rel="prefetch" href="/assets/js/405.9142a002.js"><link rel="prefetch" href="/assets/js/406.ba50e04d.js"><link rel="prefetch" href="/assets/js/407.b5271c6f.js"><link rel="prefetch" href="/assets/js/408.18baa241.js"><link rel="prefetch" href="/assets/js/409.6151d46b.js"><link rel="prefetch" href="/assets/js/41.b10ef41f.js"><link rel="prefetch" href="/assets/js/410.bb1fd058.js"><link rel="prefetch" href="/assets/js/411.9273fd47.js"><link rel="prefetch" href="/assets/js/412.d6b790c1.js"><link rel="prefetch" href="/assets/js/413.4c5a30bb.js"><link rel="prefetch" href="/assets/js/414.01aa0e0a.js"><link rel="prefetch" href="/assets/js/415.9321c4cf.js"><link rel="prefetch" href="/assets/js/416.7a2263a9.js"><link rel="prefetch" href="/assets/js/417.98368241.js"><link rel="prefetch" href="/assets/js/418.ffeb9c9c.js"><link rel="prefetch" href="/assets/js/419.633f9efe.js"><link rel="prefetch" href="/assets/js/42.aa8b7c99.js"><link rel="prefetch" href="/assets/js/420.69868f4a.js"><link rel="prefetch" href="/assets/js/421.937d87cc.js"><link rel="prefetch" href="/assets/js/422.375fe09b.js"><link rel="prefetch" href="/assets/js/423.8d335fd6.js"><link rel="prefetch" href="/assets/js/424.d5b181d7.js"><link rel="prefetch" href="/assets/js/425.9d3bbd92.js"><link rel="prefetch" href="/assets/js/426.1dcc36fa.js"><link rel="prefetch" href="/assets/js/427.c26079c3.js"><link rel="prefetch" href="/assets/js/428.788e60b3.js"><link rel="prefetch" href="/assets/js/429.212c3091.js"><link rel="prefetch" href="/assets/js/43.4543e0d9.js"><link rel="prefetch" href="/assets/js/430.1dc4217d.js"><link rel="prefetch" href="/assets/js/431.b41e44c6.js"><link rel="prefetch" href="/assets/js/432.7af71b66.js"><link rel="prefetch" href="/assets/js/433.3d203e2b.js"><link rel="prefetch" href="/assets/js/434.41bb5350.js"><link rel="prefetch" href="/assets/js/435.fb857c98.js"><link rel="prefetch" href="/assets/js/436.60910866.js"><link rel="prefetch" href="/assets/js/437.3e876081.js"><link rel="prefetch" href="/assets/js/438.52489db1.js"><link rel="prefetch" href="/assets/js/439.0de7c2a4.js"><link rel="prefetch" href="/assets/js/44.c0079627.js"><link rel="prefetch" href="/assets/js/440.43bc725f.js"><link rel="prefetch" href="/assets/js/441.1402dd2a.js"><link rel="prefetch" href="/assets/js/442.6106e1be.js"><link rel="prefetch" href="/assets/js/443.64c24a88.js"><link rel="prefetch" href="/assets/js/444.7c511693.js"><link rel="prefetch" href="/assets/js/445.8636f7a3.js"><link rel="prefetch" href="/assets/js/446.cb623223.js"><link rel="prefetch" href="/assets/js/447.541814ab.js"><link rel="prefetch" href="/assets/js/448.76a49f28.js"><link rel="prefetch" href="/assets/js/449.9ccc7564.js"><link rel="prefetch" href="/assets/js/45.2a09d581.js"><link rel="prefetch" href="/assets/js/450.4a11c620.js"><link rel="prefetch" href="/assets/js/451.ee1b8ff8.js"><link rel="prefetch" href="/assets/js/452.57d90f9d.js"><link rel="prefetch" href="/assets/js/453.39a21d52.js"><link rel="prefetch" href="/assets/js/454.6511d1e1.js"><link rel="prefetch" href="/assets/js/455.0eed4c6d.js"><link rel="prefetch" href="/assets/js/456.52c6b497.js"><link rel="prefetch" href="/assets/js/457.5fa63ace.js"><link rel="prefetch" href="/assets/js/458.c4b97e35.js"><link rel="prefetch" href="/assets/js/459.dd63aef0.js"><link rel="prefetch" href="/assets/js/46.0818f126.js"><link rel="prefetch" href="/assets/js/460.a22ac002.js"><link rel="prefetch" href="/assets/js/461.20961c89.js"><link rel="prefetch" href="/assets/js/462.ee2c5681.js"><link rel="prefetch" href="/assets/js/463.d8d3391e.js"><link rel="prefetch" href="/assets/js/464.f22ba288.js"><link rel="prefetch" href="/assets/js/465.9c187041.js"><link rel="prefetch" href="/assets/js/466.bb610d7e.js"><link rel="prefetch" href="/assets/js/467.2e6d2335.js"><link rel="prefetch" href="/assets/js/468.425b6f20.js"><link rel="prefetch" href="/assets/js/469.3de046d1.js"><link rel="prefetch" href="/assets/js/47.9ffc261e.js"><link rel="prefetch" href="/assets/js/470.56b23b5d.js"><link rel="prefetch" href="/assets/js/471.52f12555.js"><link rel="prefetch" href="/assets/js/472.3a1ad521.js"><link rel="prefetch" href="/assets/js/473.2be352ab.js"><link rel="prefetch" href="/assets/js/474.e9c805de.js"><link rel="prefetch" href="/assets/js/475.93cab6cb.js"><link rel="prefetch" href="/assets/js/476.89384fa4.js"><link rel="prefetch" href="/assets/js/477.2b282ee8.js"><link rel="prefetch" href="/assets/js/478.654c3704.js"><link rel="prefetch" href="/assets/js/479.62e088ac.js"><link rel="prefetch" href="/assets/js/48.e1e2c574.js"><link rel="prefetch" href="/assets/js/480.bd0beea9.js"><link rel="prefetch" href="/assets/js/481.365fe82a.js"><link rel="prefetch" href="/assets/js/482.b42773a2.js"><link rel="prefetch" href="/assets/js/483.06307583.js"><link rel="prefetch" href="/assets/js/484.89fc82a9.js"><link rel="prefetch" href="/assets/js/485.d38ba4c2.js"><link rel="prefetch" href="/assets/js/486.ed91c8b7.js"><link rel="prefetch" href="/assets/js/487.18010c30.js"><link rel="prefetch" href="/assets/js/488.b4a6f06e.js"><link rel="prefetch" href="/assets/js/489.7c7adc5c.js"><link rel="prefetch" href="/assets/js/49.86de3a64.js"><link rel="prefetch" href="/assets/js/490.3f86a6a4.js"><link rel="prefetch" href="/assets/js/491.c1c90b4f.js"><link rel="prefetch" href="/assets/js/492.9b0b2968.js"><link rel="prefetch" href="/assets/js/493.ab4f5219.js"><link rel="prefetch" href="/assets/js/494.80e3d4f4.js"><link rel="prefetch" href="/assets/js/495.cd43108c.js"><link rel="prefetch" href="/assets/js/496.cc77f0cc.js"><link rel="prefetch" href="/assets/js/497.7f012a61.js"><link rel="prefetch" href="/assets/js/498.e2dcd450.js"><link rel="prefetch" href="/assets/js/499.1eb65f15.js"><link rel="prefetch" href="/assets/js/5.f343fd5d.js"><link rel="prefetch" href="/assets/js/50.eaf6c9df.js"><link rel="prefetch" href="/assets/js/500.a8dff429.js"><link rel="prefetch" href="/assets/js/501.08ff03e1.js"><link rel="prefetch" href="/assets/js/502.7d4d351b.js"><link rel="prefetch" href="/assets/js/503.b72fa6a8.js"><link rel="prefetch" href="/assets/js/504.60780a8e.js"><link rel="prefetch" href="/assets/js/505.56edff2f.js"><link rel="prefetch" href="/assets/js/506.25473979.js"><link rel="prefetch" href="/assets/js/507.3cf0d2d7.js"><link rel="prefetch" href="/assets/js/508.b1384524.js"><link rel="prefetch" href="/assets/js/509.a4321e30.js"><link rel="prefetch" href="/assets/js/51.bc8d5aaf.js"><link rel="prefetch" href="/assets/js/510.266a6048.js"><link rel="prefetch" href="/assets/js/511.6449c5f4.js"><link rel="prefetch" href="/assets/js/512.46d7ec78.js"><link rel="prefetch" href="/assets/js/513.837b9052.js"><link rel="prefetch" href="/assets/js/514.6367dfac.js"><link rel="prefetch" href="/assets/js/515.c08327b5.js"><link rel="prefetch" href="/assets/js/516.3b4189d4.js"><link rel="prefetch" href="/assets/js/517.30f6149f.js"><link rel="prefetch" href="/assets/js/518.543bea6f.js"><link rel="prefetch" href="/assets/js/519.5203f10c.js"><link rel="prefetch" href="/assets/js/52.20603f07.js"><link rel="prefetch" href="/assets/js/520.0a3034db.js"><link rel="prefetch" href="/assets/js/521.40210ec3.js"><link rel="prefetch" href="/assets/js/522.6ae45427.js"><link rel="prefetch" href="/assets/js/523.4b5d705c.js"><link rel="prefetch" href="/assets/js/524.24354cd8.js"><link rel="prefetch" href="/assets/js/525.d201b688.js"><link rel="prefetch" href="/assets/js/526.5a310047.js"><link rel="prefetch" href="/assets/js/527.f21b5ed9.js"><link rel="prefetch" href="/assets/js/528.cb45a5dd.js"><link rel="prefetch" href="/assets/js/529.aeec69e2.js"><link rel="prefetch" href="/assets/js/53.3dfede5f.js"><link rel="prefetch" href="/assets/js/530.7d5514c0.js"><link rel="prefetch" href="/assets/js/531.232875bc.js"><link rel="prefetch" href="/assets/js/532.31b6e993.js"><link rel="prefetch" href="/assets/js/533.23335bff.js"><link rel="prefetch" href="/assets/js/534.131d260d.js"><link rel="prefetch" href="/assets/js/535.325fb780.js"><link rel="prefetch" href="/assets/js/536.3a6e04f7.js"><link rel="prefetch" href="/assets/js/537.fba0dff9.js"><link rel="prefetch" href="/assets/js/538.484e78e3.js"><link rel="prefetch" href="/assets/js/539.f5b9d795.js"><link rel="prefetch" href="/assets/js/54.0672652f.js"><link rel="prefetch" href="/assets/js/540.e1469d60.js"><link rel="prefetch" href="/assets/js/541.19aca35c.js"><link rel="prefetch" href="/assets/js/542.ef21521b.js"><link rel="prefetch" href="/assets/js/543.28f4c11d.js"><link rel="prefetch" href="/assets/js/544.7a557763.js"><link rel="prefetch" href="/assets/js/545.d4a3a0b1.js"><link rel="prefetch" href="/assets/js/546.8227bb93.js"><link rel="prefetch" href="/assets/js/547.a25f9f1f.js"><link rel="prefetch" href="/assets/js/548.75912f14.js"><link rel="prefetch" href="/assets/js/549.f7913ea7.js"><link rel="prefetch" href="/assets/js/55.eccc64f8.js"><link rel="prefetch" href="/assets/js/550.c127415f.js"><link rel="prefetch" href="/assets/js/551.b0fb00d7.js"><link rel="prefetch" href="/assets/js/552.65dd0c96.js"><link rel="prefetch" href="/assets/js/553.8f54c217.js"><link rel="prefetch" href="/assets/js/554.0f0110aa.js"><link rel="prefetch" href="/assets/js/555.20d92271.js"><link rel="prefetch" href="/assets/js/556.eaa87d9e.js"><link rel="prefetch" href="/assets/js/557.56935b3b.js"><link rel="prefetch" href="/assets/js/558.2663dd29.js"><link rel="prefetch" href="/assets/js/559.64b054ed.js"><link rel="prefetch" href="/assets/js/56.17ce588e.js"><link rel="prefetch" href="/assets/js/560.96438103.js"><link rel="prefetch" href="/assets/js/561.3f954ead.js"><link rel="prefetch" href="/assets/js/562.af9ebd91.js"><link rel="prefetch" href="/assets/js/563.ddd66296.js"><link rel="prefetch" href="/assets/js/564.2f68f72a.js"><link rel="prefetch" href="/assets/js/565.01bce6c3.js"><link rel="prefetch" href="/assets/js/566.a52f9105.js"><link rel="prefetch" href="/assets/js/567.859ac364.js"><link rel="prefetch" href="/assets/js/568.5b8b956b.js"><link rel="prefetch" href="/assets/js/569.0579b985.js"><link rel="prefetch" href="/assets/js/57.b5fa419a.js"><link rel="prefetch" href="/assets/js/570.d09f7f64.js"><link rel="prefetch" href="/assets/js/571.56e5f721.js"><link rel="prefetch" href="/assets/js/572.df9b48f1.js"><link rel="prefetch" href="/assets/js/573.224ada77.js"><link rel="prefetch" href="/assets/js/574.b86bedad.js"><link rel="prefetch" href="/assets/js/575.5de505a0.js"><link rel="prefetch" href="/assets/js/576.3f005df8.js"><link rel="prefetch" href="/assets/js/577.67c56f69.js"><link rel="prefetch" href="/assets/js/578.ecc86424.js"><link rel="prefetch" href="/assets/js/579.97aaa2ed.js"><link rel="prefetch" href="/assets/js/58.f28ad3cc.js"><link rel="prefetch" href="/assets/js/580.227b7eac.js"><link rel="prefetch" href="/assets/js/581.fb9b8da8.js"><link rel="prefetch" href="/assets/js/582.56048491.js"><link rel="prefetch" href="/assets/js/583.7b73623c.js"><link rel="prefetch" href="/assets/js/584.f0d8c622.js"><link rel="prefetch" href="/assets/js/585.3501b2bf.js"><link rel="prefetch" href="/assets/js/586.c359098c.js"><link rel="prefetch" href="/assets/js/587.5f4468bd.js"><link rel="prefetch" href="/assets/js/588.13f6d1b8.js"><link rel="prefetch" href="/assets/js/589.3aba094e.js"><link rel="prefetch" href="/assets/js/59.9079a4f5.js"><link rel="prefetch" href="/assets/js/590.66f0672c.js"><link rel="prefetch" href="/assets/js/591.e4de1988.js"><link rel="prefetch" href="/assets/js/592.f479d891.js"><link rel="prefetch" href="/assets/js/593.f0e27fdf.js"><link rel="prefetch" href="/assets/js/594.13045593.js"><link rel="prefetch" href="/assets/js/595.24cce867.js"><link rel="prefetch" href="/assets/js/596.c5f1641f.js"><link rel="prefetch" href="/assets/js/597.5d8c531f.js"><link rel="prefetch" href="/assets/js/598.a4f73bf5.js"><link rel="prefetch" href="/assets/js/599.b9db932d.js"><link rel="prefetch" href="/assets/js/6.20e5c5a2.js"><link rel="prefetch" href="/assets/js/60.de27b06a.js"><link rel="prefetch" href="/assets/js/600.7dbabf0f.js"><link rel="prefetch" href="/assets/js/601.34cfecd2.js"><link rel="prefetch" href="/assets/js/602.afaf2e1f.js"><link rel="prefetch" href="/assets/js/603.5f081041.js"><link rel="prefetch" href="/assets/js/604.a55dc3e4.js"><link rel="prefetch" href="/assets/js/605.cc600bca.js"><link rel="prefetch" href="/assets/js/606.9e0874e1.js"><link rel="prefetch" href="/assets/js/607.bd0a2835.js"><link rel="prefetch" href="/assets/js/608.e3c0bb6d.js"><link rel="prefetch" href="/assets/js/609.968adfbe.js"><link rel="prefetch" href="/assets/js/61.cd58c0e2.js"><link rel="prefetch" href="/assets/js/610.6ddb82e2.js"><link rel="prefetch" href="/assets/js/611.f6573e33.js"><link rel="prefetch" href="/assets/js/612.cd703232.js"><link rel="prefetch" href="/assets/js/613.5ae48097.js"><link rel="prefetch" href="/assets/js/614.c9fc5628.js"><link rel="prefetch" href="/assets/js/615.5f3c1162.js"><link rel="prefetch" href="/assets/js/616.3efeed17.js"><link rel="prefetch" href="/assets/js/617.25dec672.js"><link rel="prefetch" href="/assets/js/618.c06b0d32.js"><link rel="prefetch" href="/assets/js/619.5d866d4c.js"><link rel="prefetch" href="/assets/js/62.aa4d202d.js"><link rel="prefetch" href="/assets/js/620.88136c6a.js"><link rel="prefetch" href="/assets/js/621.494122df.js"><link rel="prefetch" href="/assets/js/622.e2a6e4bd.js"><link rel="prefetch" href="/assets/js/623.20a56d61.js"><link rel="prefetch" href="/assets/js/624.602dd933.js"><link rel="prefetch" href="/assets/js/625.70f44f60.js"><link rel="prefetch" href="/assets/js/626.11524978.js"><link rel="prefetch" href="/assets/js/627.b3badb72.js"><link rel="prefetch" href="/assets/js/628.e613665e.js"><link rel="prefetch" href="/assets/js/629.20e73b43.js"><link rel="prefetch" href="/assets/js/63.f7cd40f4.js"><link rel="prefetch" href="/assets/js/630.b6b6993b.js"><link rel="prefetch" href="/assets/js/631.a54facea.js"><link rel="prefetch" href="/assets/js/632.d33f5ec9.js"><link rel="prefetch" href="/assets/js/633.211456ee.js"><link rel="prefetch" href="/assets/js/634.ea9d07ae.js"><link rel="prefetch" href="/assets/js/635.f22368f1.js"><link rel="prefetch" href="/assets/js/636.64523984.js"><link rel="prefetch" href="/assets/js/637.6e8d116d.js"><link rel="prefetch" href="/assets/js/638.4565c395.js"><link rel="prefetch" href="/assets/js/639.c5144f9c.js"><link rel="prefetch" href="/assets/js/64.32e36797.js"><link rel="prefetch" href="/assets/js/640.2dc2eba9.js"><link rel="prefetch" href="/assets/js/641.70155ce7.js"><link rel="prefetch" href="/assets/js/642.c55f5ca8.js"><link rel="prefetch" href="/assets/js/643.69a5b8e5.js"><link rel="prefetch" href="/assets/js/644.e4c69ba3.js"><link rel="prefetch" href="/assets/js/645.f8972cce.js"><link rel="prefetch" href="/assets/js/646.506fc745.js"><link rel="prefetch" href="/assets/js/647.e5f03652.js"><link rel="prefetch" href="/assets/js/648.47ae0cc5.js"><link rel="prefetch" href="/assets/js/649.b3a67529.js"><link rel="prefetch" href="/assets/js/65.9b846f9f.js"><link rel="prefetch" href="/assets/js/650.89765bb0.js"><link rel="prefetch" href="/assets/js/651.19b73cf8.js"><link rel="prefetch" href="/assets/js/652.4436725f.js"><link rel="prefetch" href="/assets/js/653.391168ff.js"><link rel="prefetch" href="/assets/js/654.8b449d07.js"><link rel="prefetch" href="/assets/js/655.27051c8c.js"><link rel="prefetch" href="/assets/js/656.7adaae31.js"><link rel="prefetch" href="/assets/js/657.4fee46d2.js"><link rel="prefetch" href="/assets/js/658.0243a6e8.js"><link rel="prefetch" href="/assets/js/659.fc6c50f4.js"><link rel="prefetch" href="/assets/js/66.87cbf0a3.js"><link rel="prefetch" href="/assets/js/660.f0794bab.js"><link rel="prefetch" href="/assets/js/661.980d3d5a.js"><link rel="prefetch" href="/assets/js/662.79643730.js"><link rel="prefetch" href="/assets/js/663.d030bd1d.js"><link rel="prefetch" href="/assets/js/664.32b3c0e8.js"><link rel="prefetch" href="/assets/js/665.384c456b.js"><link rel="prefetch" href="/assets/js/666.2672eb36.js"><link rel="prefetch" href="/assets/js/667.2ca85ff9.js"><link rel="prefetch" href="/assets/js/668.b80ef3b4.js"><link rel="prefetch" href="/assets/js/669.41f08cb1.js"><link rel="prefetch" href="/assets/js/67.c0e799e4.js"><link rel="prefetch" href="/assets/js/670.48512f45.js"><link rel="prefetch" href="/assets/js/671.93e1cdd9.js"><link rel="prefetch" href="/assets/js/672.aa2a7e31.js"><link rel="prefetch" href="/assets/js/673.b19ed80d.js"><link rel="prefetch" href="/assets/js/674.0337bf32.js"><link rel="prefetch" href="/assets/js/675.88a9d569.js"><link rel="prefetch" href="/assets/js/676.7fd2de1c.js"><link rel="prefetch" href="/assets/js/677.1356b477.js"><link rel="prefetch" href="/assets/js/678.d99fd658.js"><link rel="prefetch" href="/assets/js/679.a2e40bc7.js"><link rel="prefetch" href="/assets/js/68.a0900b05.js"><link rel="prefetch" href="/assets/js/680.58e5d76e.js"><link rel="prefetch" href="/assets/js/681.2e66d773.js"><link rel="prefetch" href="/assets/js/682.42526013.js"><link rel="prefetch" href="/assets/js/683.447d4972.js"><link rel="prefetch" href="/assets/js/684.19beb22a.js"><link rel="prefetch" href="/assets/js/685.cd3fd615.js"><link rel="prefetch" href="/assets/js/686.c6200f3f.js"><link rel="prefetch" href="/assets/js/687.3d6cf8bb.js"><link rel="prefetch" href="/assets/js/688.e9ddd041.js"><link rel="prefetch" href="/assets/js/689.d9ae26a7.js"><link rel="prefetch" href="/assets/js/69.46e92a94.js"><link rel="prefetch" href="/assets/js/690.82b51acd.js"><link rel="prefetch" href="/assets/js/691.1de98534.js"><link rel="prefetch" href="/assets/js/692.c5fd2fa7.js"><link rel="prefetch" href="/assets/js/693.0c0b8126.js"><link rel="prefetch" href="/assets/js/694.551ae4d1.js"><link rel="prefetch" href="/assets/js/695.2801a2f2.js"><link rel="prefetch" href="/assets/js/696.b042b472.js"><link rel="prefetch" href="/assets/js/697.2268ef66.js"><link rel="prefetch" href="/assets/js/698.083f2a36.js"><link rel="prefetch" href="/assets/js/699.c82907d3.js"><link rel="prefetch" href="/assets/js/7.54cc9ff2.js"><link rel="prefetch" href="/assets/js/70.358bb057.js"><link rel="prefetch" href="/assets/js/700.9faf8917.js"><link rel="prefetch" href="/assets/js/701.5ce77f04.js"><link rel="prefetch" href="/assets/js/702.488262eb.js"><link rel="prefetch" href="/assets/js/703.8f79363d.js"><link rel="prefetch" href="/assets/js/704.a4cfe8cb.js"><link rel="prefetch" href="/assets/js/705.4f1759eb.js"><link rel="prefetch" href="/assets/js/706.d69115ff.js"><link rel="prefetch" href="/assets/js/707.48c01840.js"><link rel="prefetch" href="/assets/js/708.b3cda177.js"><link rel="prefetch" href="/assets/js/709.260cc3a8.js"><link rel="prefetch" href="/assets/js/71.aef535c9.js"><link rel="prefetch" href="/assets/js/710.e4fa6646.js"><link rel="prefetch" href="/assets/js/711.7816aba5.js"><link rel="prefetch" href="/assets/js/712.14939ffd.js"><link rel="prefetch" href="/assets/js/72.9793c1ce.js"><link rel="prefetch" href="/assets/js/73.ac8cddbb.js"><link rel="prefetch" href="/assets/js/74.1d313482.js"><link rel="prefetch" href="/assets/js/75.d22f9016.js"><link rel="prefetch" href="/assets/js/76.18b52e68.js"><link rel="prefetch" href="/assets/js/77.f9258c97.js"><link rel="prefetch" href="/assets/js/78.55656c0f.js"><link rel="prefetch" href="/assets/js/79.12ecc291.js"><link rel="prefetch" href="/assets/js/8.44118d7c.js"><link rel="prefetch" href="/assets/js/80.6047e44e.js"><link rel="prefetch" href="/assets/js/81.5421fa90.js"><link rel="prefetch" href="/assets/js/82.72a10ccf.js"><link rel="prefetch" href="/assets/js/83.abdca93e.js"><link rel="prefetch" href="/assets/js/84.890d0c52.js"><link rel="prefetch" href="/assets/js/85.9b610a1c.js"><link rel="prefetch" href="/assets/js/86.b68daf67.js"><link rel="prefetch" href="/assets/js/87.bfe2bb57.js"><link rel="prefetch" href="/assets/js/88.4097611c.js"><link rel="prefetch" href="/assets/js/89.e5a98da0.js"><link rel="prefetch" href="/assets/js/9.612b54fd.js"><link rel="prefetch" href="/assets/js/90.04e01a5c.js"><link rel="prefetch" href="/assets/js/91.ff219511.js"><link rel="prefetch" href="/assets/js/92.c257263c.js"><link rel="prefetch" href="/assets/js/93.4b6ecb16.js"><link rel="prefetch" href="/assets/js/94.fd999a73.js"><link rel="prefetch" href="/assets/js/95.d1dbefdc.js"><link rel="prefetch" href="/assets/js/96.0ed81c74.js"><link rel="prefetch" href="/assets/js/97.f2650da8.js"><link rel="prefetch" href="/assets/js/98.f9ef7bdb.js"><link rel="prefetch" href="/assets/js/99.2d7ddb43.js"><link rel="prefetch" href="/assets/js/vendors~docsearch.49ad9c45.js">
    <link rel="stylesheet" href="/assets/css/0.styles.28585500.css">
  </head>
  <body>
    <div id="app" data-server-rendered="true"><div class="theme-container"><header class="navbar"><div class="sidebar-button"><svg xmlns="http://www.w3.org/2000/svg" aria-hidden="true" role="img" viewBox="0 0 448 512" class="icon"><path fill="currentColor" d="M436 124H12c-6.627 0-12-5.373-12-12V80c0-6.627 5.373-12 12-12h424c6.627 0 12 5.373 12 12v32c0 6.627-5.373 12-12 12zm0 160H12c-6.627 0-12-5.373-12-12v-32c0-6.627 5.373-12 12-12h424c6.627 0 12 5.373 12 12v32c0 6.627-5.373 12-12 12zm0 160H12c-6.627 0-12-5.373-12-12v-32c0-6.627 5.373-12 12-12h424c6.627 0 12 5.373 12 12v32c0 6.627-5.373 12-12 12z"></path></svg></div> <a href="/en/" class="home-link router-link-active"><img src="/images/icons/spring-logo.svg" alt="Spring Docs" class="logo"> <span class="site-name can-hide">Spring Docs</span></a> <div class="links"><div class="search-box"><input aria-label="Search" autocomplete="off" spellcheck="false" value=""> <!----></div> <nav class="nav-links can-hide"><div class="nav-item"><a href="/en/spring/why-spring.html" class="nav-link">
  Spring
</a></div><div class="nav-item"><a href="/en/spring-boot/getting-help.html" class="nav-link">
  Spring Boot
</a></div><div class="nav-item"><a href="/en/spring-cloud/documentation-overview.html" class="nav-link">
  Spring Cloud
</a></div><div class="nav-item"><div class="dropdown-wrapper"><button type="button" aria-label="Others" class="dropdown-title"><span class="title">more</span> <span class="arrow down"></span></button> <button type="button" aria-label="Others" class="mobile-dropdown-title"><span class="title">more</span> <span class="arrow right"></span></button> <ul class="nav-dropdown" style="display:none;"><li class="dropdown-item"><!----> <a href="/en/spring-framework/overview.html" class="nav-link">
  Spring Framework
</a></li><li class="dropdown-item"><!----> <a href="/en/spring-data/spring-data.html" class="nav-link">
  Spring Data
</a></li><li class="dropdown-item"><!----> <a href="/en/spring-cloud-data-flow/spring-cloud-dataflow.html" class="nav-link">
  Spring Cloud Data Flow
</a></li><li class="dropdown-item"><!----> <a href="/en/spring-security/overview.html" class="nav-link">
  Spring Security
</a></li><li class="dropdown-item"><!----> <a href="/en/spring-for-graphql/spring-graphql.html" class="nav-link">
  Spring for GraphQL
</a></li><li class="dropdown-item"><!----> <a href="/en/spring-session/_index.html" class="nav-link">
  Spring Session
</a></li><li class="dropdown-item"><!----> <a href="/en/spring-integration/preface.html" class="nav-link">
  Spring Integration
</a></li><li class="dropdown-item"><!----> <a href="/en/spring-hateoas/spring-hateoas.html" class="nav-link">
  Spring HATEOAS
</a></li><li class="dropdown-item"><!----> <a href="/en/spring-rest-docs/spring-restdocs.html" class="nav-link">
  Spring REST Docs
</a></li><li class="dropdown-item"><!----> <a href="/en/spring-batch/spring-batch-intro.html" class="nav-link">
  Spring Batch
</a></li><li class="dropdown-item"><!----> <a href="/en/spring-amqp/spring-amqp.html" class="nav-link">
  Spring AMQP
</a></li><li class="dropdown-item"><!----> <a href="/en/spring-credhub/spring-credhub.html" class="nav-link">
  Spring CredHub
</a></li><li class="dropdown-item"><!----> <a href="/en/spring-flo/spring-flo.html" class="nav-link">
  Spring Flo
</a></li><li class="dropdown-item"><!----> <a href="/en/spring-for-apache-kafka/spring-kafka.html" class="nav-link">
  Spring for Apache Kafka
</a></li><li class="dropdown-item"><!----> <a href="/en/spring-ldap/spring-ldap.html" class="nav-link">
  Spring LDAP
</a></li><li class="dropdown-item"><!----> <a href="/en/spring-shell/spring-shell.html" class="nav-link">
  Spring Shell
</a></li><li class="dropdown-item"><!----> <a href="/en/spring-statemachine/spring-statemachine.html" class="nav-link">
  Spring Statemachine
</a></li><li class="dropdown-item"><!----> <a href="/en/spring-vault/spring-vault.html" class="nav-link">
  Spring Vault
</a></li><li class="dropdown-item"><!----> <a href="/en/spring-web-flow/preface.html" class="nav-link">
  Spring Web Flow
</a></li><li class="dropdown-item"><!----> <a href="/en/spring-web-services/spring-web-service.html" class="nav-link">
  Spring Web Services
</a></li></ul></div></div><div class="nav-item"><div class="dropdown-wrapper"><button type="button" aria-label="Select language" class="dropdown-title"><span class="title">Language</span> <span class="arrow down"></span></button> <button type="button" aria-label="Select language" class="mobile-dropdown-title"><span class="title">Language</span> <span class="arrow right"></span></button> <ul class="nav-dropdown" style="display:none;"><li class="dropdown-item"><!----> <a href="/en/spring-security/features-authentication-password-storage.html" aria-current="page" class="nav-link router-link-exact-active router-link-active">
  English
</a></li><li class="dropdown-item"><!----> <a href="/spring-security/features-authentication-password-storage.html" class="nav-link">
  简体中文
</a></li></ul></div></div> <a href="https://gitcode.net/dev-cloud/spring-docs" target="_blank" rel="noopener noreferrer" class="repo-link">
    GitCode
    <span><svg xmlns="http://www.w3.org/2000/svg" aria-hidden="true" focusable="false" x="0px" y="0px" viewBox="0 0 100 100" width="15" height="15" class="icon outbound"><path fill="currentColor" d="M18.8,85.1h56l0,0c2.2,0,4-1.8,4-4v-32h-8v28h-48v-48h28v-8h-32l0,0c-2.2,0-4,1.8-4,4v56C14.8,83.3,16.6,85.1,18.8,85.1z"></path> <polygon fill="currentColor" points="45.7,48.7 51.3,54.3 77.2,28.5 77.2,37.2 85.2,37.2 85.2,14.9 62.8,14.9 62.8,22.9 71.5,22.9"></polygon></svg> <span class="sr-only">(opens new window)</span></span></a></nav></div></header> <div class="sidebar-mask"></div> <aside class="sidebar"><nav class="nav-links"><div class="nav-item"><a href="/en/spring/why-spring.html" class="nav-link">
  Spring
</a></div><div class="nav-item"><a href="/en/spring-boot/getting-help.html" class="nav-link">
  Spring Boot
</a></div><div class="nav-item"><a href="/en/spring-cloud/documentation-overview.html" class="nav-link">
  Spring Cloud
</a></div><div class="nav-item"><div class="dropdown-wrapper"><button type="button" aria-label="Others" class="dropdown-title"><span class="title">more</span> <span class="arrow down"></span></button> <button type="button" aria-label="Others" class="mobile-dropdown-title"><span class="title">more</span> <span class="arrow right"></span></button> <ul class="nav-dropdown" style="display:none;"><li class="dropdown-item"><!----> <a href="/en/spring-framework/overview.html" class="nav-link">
  Spring Framework
</a></li><li class="dropdown-item"><!----> <a href="/en/spring-data/spring-data.html" class="nav-link">
  Spring Data
</a></li><li class="dropdown-item"><!----> <a href="/en/spring-cloud-data-flow/spring-cloud-dataflow.html" class="nav-link">
  Spring Cloud Data Flow
</a></li><li class="dropdown-item"><!----> <a href="/en/spring-security/overview.html" class="nav-link">
  Spring Security
</a></li><li class="dropdown-item"><!----> <a href="/en/spring-for-graphql/spring-graphql.html" class="nav-link">
  Spring for GraphQL
</a></li><li class="dropdown-item"><!----> <a href="/en/spring-session/_index.html" class="nav-link">
  Spring Session
</a></li><li class="dropdown-item"><!----> <a href="/en/spring-integration/preface.html" class="nav-link">
  Spring Integration
</a></li><li class="dropdown-item"><!----> <a href="/en/spring-hateoas/spring-hateoas.html" class="nav-link">
  Spring HATEOAS
</a></li><li class="dropdown-item"><!----> <a href="/en/spring-rest-docs/spring-restdocs.html" class="nav-link">
  Spring REST Docs
</a></li><li class="dropdown-item"><!----> <a href="/en/spring-batch/spring-batch-intro.html" class="nav-link">
  Spring Batch
</a></li><li class="dropdown-item"><!----> <a href="/en/spring-amqp/spring-amqp.html" class="nav-link">
  Spring AMQP
</a></li><li class="dropdown-item"><!----> <a href="/en/spring-credhub/spring-credhub.html" class="nav-link">
  Spring CredHub
</a></li><li class="dropdown-item"><!----> <a href="/en/spring-flo/spring-flo.html" class="nav-link">
  Spring Flo
</a></li><li class="dropdown-item"><!----> <a href="/en/spring-for-apache-kafka/spring-kafka.html" class="nav-link">
  Spring for Apache Kafka
</a></li><li class="dropdown-item"><!----> <a href="/en/spring-ldap/spring-ldap.html" class="nav-link">
  Spring LDAP
</a></li><li class="dropdown-item"><!----> <a href="/en/spring-shell/spring-shell.html" class="nav-link">
  Spring Shell
</a></li><li class="dropdown-item"><!----> <a href="/en/spring-statemachine/spring-statemachine.html" class="nav-link">
  Spring Statemachine
</a></li><li class="dropdown-item"><!----> <a href="/en/spring-vault/spring-vault.html" class="nav-link">
  Spring Vault
</a></li><li class="dropdown-item"><!----> <a href="/en/spring-web-flow/preface.html" class="nav-link">
  Spring Web Flow
</a></li><li class="dropdown-item"><!----> <a href="/en/spring-web-services/spring-web-service.html" class="nav-link">
  Spring Web Services
</a></li></ul></div></div><div class="nav-item"><div class="dropdown-wrapper"><button type="button" aria-label="Select language" class="dropdown-title"><span class="title">Language</span> <span class="arrow down"></span></button> <button type="button" aria-label="Select language" class="mobile-dropdown-title"><span class="title">Language</span> <span class="arrow right"></span></button> <ul class="nav-dropdown" style="display:none;"><li class="dropdown-item"><!----> <a href="/en/spring-security/features-authentication-password-storage.html" aria-current="page" class="nav-link router-link-exact-active router-link-active">
  English
</a></li><li class="dropdown-item"><!----> <a href="/spring-security/features-authentication-password-storage.html" class="nav-link">
  简体中文
</a></li></ul></div></div> <a href="https://gitcode.net/dev-cloud/spring-docs" target="_blank" rel="noopener noreferrer" class="repo-link">
    GitCode
    <span><svg xmlns="http://www.w3.org/2000/svg" aria-hidden="true" focusable="false" x="0px" y="0px" viewBox="0 0 100 100" width="15" height="15" class="icon outbound"><path fill="currentColor" d="M18.8,85.1h56l0,0c2.2,0,4-1.8,4-4v-32h-8v28h-48v-48h28v-8h-32l0,0c-2.2,0-4,1.8-4,4v56C14.8,83.3,16.6,85.1,18.8,85.1z"></path> <polygon fill="currentColor" points="45.7,48.7 51.3,54.3 77.2,28.5 77.2,37.2 85.2,37.2 85.2,14.9 62.8,14.9 62.8,22.9 71.5,22.9"></polygon></svg> <span class="sr-only">(opens new window)</span></span></a></nav>  <ul class="sidebar-links"><li><section class="sidebar-group depth-0"><p class="sidebar-heading open"><span>Spring Security</span> <!----></p> <ul class="sidebar-links sidebar-group-items"><li><a href="/en/spring-security/overview.html" class="sidebar-link">Spring Security</a></li><li><a href="/en/spring-security/prerequisites.html" class="sidebar-link">Prerequisites</a></li><li><a href="/en/spring-security/community.html" class="sidebar-link">Spring Security Community</a></li><li><a href="/en/spring-security/whats-new.html" class="sidebar-link">What’s New in Spring Security 5.6</a></li><li><a href="/en/spring-security/getting-spring-security.html" class="sidebar-link">Getting Spring Security</a></li><li><a href="/en/spring-security/features.html" class="sidebar-link">Features</a></li><li><a href="/en/spring-security/features-authentication.html" class="sidebar-link">Authentication</a></li><li><a href="/en/spring-security/features-authentication-password-storage.html" aria-current="page" class="active sidebar-link">Password Storage</a><ul class="sidebar-sub-headers"><li class="sidebar-sub-header"><a href="/en/spring-security/features-authentication-password-storage.html#password-storage-history" class="sidebar-link">Password Storage History</a></li><li class="sidebar-sub-header"><a href="/en/spring-security/features-authentication-password-storage.html#delegatingpasswordencoder" class="sidebar-link">DelegatingPasswordEncoder</a><ul class="sidebar-sub-headers"><li class="sidebar-sub-header"><a href="/en/spring-security/features-authentication-password-storage.html#password-storage-format" class="sidebar-link">Password Storage Format</a></li><li class="sidebar-sub-header"><a href="/en/spring-security/features-authentication-password-storage.html#password-encoding" class="sidebar-link">Password Encoding</a></li><li class="sidebar-sub-header"><a href="/en/spring-security/features-authentication-password-storage.html#password-matching" class="sidebar-link">Password Matching</a></li><li class="sidebar-sub-header"><a href="/en/spring-security/features-authentication-password-storage.html#getting-started-experience" class="sidebar-link">Getting Started Experience</a></li><li class="sidebar-sub-header"><a href="/en/spring-security/features-authentication-password-storage.html#encode-with-spring-boot-cli" class="sidebar-link">Encode with Spring Boot CLI</a></li><li class="sidebar-sub-header"><a href="/en/spring-security/features-authentication-password-storage.html#troubleshooting" class="sidebar-link">Troubleshooting</a></li></ul></li><li class="sidebar-sub-header"><a href="/en/spring-security/features-authentication-password-storage.html#bcryptpasswordencoder" class="sidebar-link">BCryptPasswordEncoder</a></li><li class="sidebar-sub-header"><a href="/en/spring-security/features-authentication-password-storage.html#argon2passwordencoder" class="sidebar-link">Argon2PasswordEncoder</a></li><li class="sidebar-sub-header"><a href="/en/spring-security/features-authentication-password-storage.html#pbkdf2passwordencoder" class="sidebar-link">Pbkdf2PasswordEncoder</a></li><li class="sidebar-sub-header"><a href="/en/spring-security/features-authentication-password-storage.html#scryptpasswordencoder" class="sidebar-link">SCryptPasswordEncoder</a></li><li class="sidebar-sub-header"><a href="/en/spring-security/features-authentication-password-storage.html#other-passwordencoders" class="sidebar-link">Other PasswordEncoders</a></li><li class="sidebar-sub-header"><a href="/en/spring-security/features-authentication-password-storage.html#password-storage-configuration" class="sidebar-link">Password Storage Configuration</a></li><li class="sidebar-sub-header"><a href="/en/spring-security/features-authentication-password-storage.html#change-password-configuration" class="sidebar-link">Change Password Configuration</a></li></ul></li><li><a href="/en/spring-security/features-exploits.html" class="sidebar-link">Protection Against Exploits</a></li><li><a href="/en/spring-security/features-exploits-csrf.html" class="sidebar-link">Cross Site Request Forgery (CSRF)</a></li><li><a href="/en/spring-security/features-exploits-headers.html" class="sidebar-link">Security HTTP Response Headers</a></li><li><a href="/en/spring-security/features-exploits-http.html" class="sidebar-link">HTTP</a></li><li><a href="/en/spring-security/features-integrations.html" class="sidebar-link">Integrations</a></li><li><a href="/en/spring-security/features-integrations-cryptography.html" class="sidebar-link">Spring Security Crypto Module</a></li><li><a href="/en/spring-security/features-integrations-data.html" class="sidebar-link">Spring Data Integration</a></li><li><a href="/en/spring-security/features-integrations-concurrency.html" class="sidebar-link">Concurrency Support</a></li><li><a href="/en/spring-security/features-integrations-jackson.html" class="sidebar-link">Jackson Support</a></li><li><a href="/en/spring-security/features-integrations-localization.html" class="sidebar-link">Localization</a></li><li><a href="/en/spring-security/modules.html" class="sidebar-link">Project Modules and Dependencies</a></li><li><a href="/en/spring-security/samples.html" class="sidebar-link">Samples</a></li><li><a href="/en/spring-security/servlet.html" class="sidebar-link">Servlet Applications</a></li><li><a href="/en/spring-security/servlet-getting-started.html" class="sidebar-link">Hello Spring Security</a></li><li><a href="/en/spring-security/servlet-architecture.html" class="sidebar-link">Architecture</a></li><li><a href="/en/spring-security/servlet-authentication.html" class="sidebar-link">Authentication</a></li><li><a href="/en/spring-security/servlet-authentication-architecture.html" class="sidebar-link">Servlet Authentication Architecture</a></li><li><a href="/en/spring-security/servlet-authentication-passwords.html" class="sidebar-link">Username/Password Authentication</a></li><li><a href="/en/spring-security/servlet-authentication-passwords-input.html" class="sidebar-link">Reading the Username &amp; Password</a></li><li><a href="/en/spring-security/servlet-authentication-passwords-form.html" class="sidebar-link">Form Login</a></li><li><a href="/en/spring-security/servlet-authentication-passwords-basic.html" class="sidebar-link">Basic Authentication</a></li><li><a href="/en/spring-security/servlet-authentication-passwords-digest.html" class="sidebar-link">Digest Authentication</a></li><li><a href="/en/spring-security/servlet-authentication-passwords-storage.html" class="sidebar-link">Storage Mechanisms</a></li><li><a href="/en/spring-security/servlet-authentication-passwords-storage-in-memory.html" class="sidebar-link">In-Memory Authentication</a></li><li><a href="/en/spring-security/servlet-authentication-passwords-storage-jdbc.html" class="sidebar-link">JDBC Authentication</a></li><li><a href="/en/spring-security/servlet-authentication-passwords-storage-user-details.html" class="sidebar-link">UserDetails</a></li><li><a href="/en/spring-security/servlet-authentication-passwords-storage-user-details-service.html" class="sidebar-link">UserDetailsService</a></li><li><a href="/en/spring-security/servlet-authentication-passwords-storage-password-encoder.html" class="sidebar-link">PasswordEncoder</a></li><li><a href="/en/spring-security/servlet-authentication-passwords-storage-dao-authentication-provider.html" class="sidebar-link">DaoAuthenticationProvider</a></li><li><a href="/en/spring-security/servlet-authentication-passwords-storage-ldap.html" class="sidebar-link">LDAP Authentication</a></li><li><a href="/en/spring-security/servlet-authentication-session-management.html" class="sidebar-link">Session Management</a></li><li><a href="/en/spring-security/servlet-authentication-rememberme.html" class="sidebar-link">Remember-Me Authentication</a></li><li><a href="/en/spring-security/servlet-authentication-openid.html" class="sidebar-link">OpenID Support</a></li><li><a href="/en/spring-security/servlet-authentication-anonymous.html" class="sidebar-link">Anonymous Authentication</a></li><li><a href="/en/spring-security/servlet-authentication-preauth.html" class="sidebar-link">Pre-Authentication Scenarios</a></li><li><a href="/en/spring-security/servlet-authentication-jaas.html" class="sidebar-link">Java Authentication and Authorization Service (JAAS) Provider</a></li><li><a href="/en/spring-security/servlet-authentication-cas.html" class="sidebar-link">CAS Authentication</a></li><li><a href="/en/spring-security/servlet-authentication-x509.html" class="sidebar-link">X.509 Authentication</a></li><li><a href="/en/spring-security/servlet-authentication-runas.html" class="sidebar-link">Run-As Authentication Replacement</a></li><li><a href="/en/spring-security/servlet-authentication-logout.html" class="sidebar-link">Handling Logouts</a></li><li><a href="/en/spring-security/servlet-authentication-events.html" class="sidebar-link">Authentication Events</a></li><li><a href="/en/spring-security/servlet-authorization-.html" class="sidebar-link">Authorization</a></li><li><a href="/en/spring-security/servlet-authorization-architecture.html" class="sidebar-link">Authorization Architecture</a></li><li><a href="/en/spring-security/servlet-authorization-authorize-http-requests.html" class="sidebar-link">Authorize HttpServletRequests with AuthorizationFilter</a></li><li><a href="/en/spring-security/servlet-authorization-authorize-requests.html" class="sidebar-link">Authorize HttpServletRequest with FilterSecurityInterceptor</a></li><li><a href="/en/spring-security/servlet-authorization-expression-based.html" class="sidebar-link">Expression-Based Access Control</a></li><li><a href="/en/spring-security/servlet-authorization-secure-objects.html" class="sidebar-link">Secure Object Implementations</a></li><li><a href="/en/spring-security/servlet-authorization-method-security.html" class="sidebar-link">Method Security</a></li><li><a href="/en/spring-security/servlet-authorization-acls.html" class="sidebar-link">Domain Object Security (ACLs)</a></li><li><a href="/en/spring-security/servlet-oauth2-.html" class="sidebar-link">OAuth2</a></li><li><a href="/en/spring-security/servlet-oauth2-login.html" class="sidebar-link">OAuth 2.0 Login</a></li><li><a href="/en/spring-security/servlet-oauth2-login-core.html" class="sidebar-link">Core Configuration</a></li><li><a href="/en/spring-security/servlet-oauth2-login-advanced.html" class="sidebar-link">Advanced Configuration</a></li><li><a href="/en/spring-security/servlet-oauth2-client.html" class="sidebar-link">OAuth 2.0 Client</a></li><li><a href="/en/spring-security/servlet-oauth2-client-core.html" class="sidebar-link">Core Interfaces / Classes</a></li><li><a href="/en/spring-security/servlet-oauth2-client-authorization-grants.html" class="sidebar-link">Authorization Grant Support</a></li><li><a href="/en/spring-security/servlet-oauth2-client-client-authentication.html" class="sidebar-link">Client Authentication Support</a></li><li><a href="/en/spring-security/servlet-oauth2-client-authorized-clients.html" class="sidebar-link">Authorized Client Features</a></li><li><a href="/en/spring-security/servlet-oauth2-resource-server.html" class="sidebar-link">OAuth 2.0 Resource Server</a></li><li><a href="/en/spring-security/servlet-oauth2-resource-server-jwt.html" class="sidebar-link">OAuth 2.0 Resource Server JWT</a></li><li><a href="/en/spring-security/servlet-oauth2-resource-server-opaque-token.html" class="sidebar-link">OAuth 2.0 Resource Server Opaque Token</a></li><li><a href="/en/spring-security/servlet-oauth2-resource-server-multitenancy.html" class="sidebar-link">OAuth 2.0 Resource Server Multitenancy</a></li><li><a href="/en/spring-security/servlet-oauth2-resource-server-bearer-tokens.html" class="sidebar-link">OAuth 2.0 Bearer Tokens</a></li><li><a href="/en/spring-security/servlet-saml2.html" class="sidebar-link">SAML2</a></li><li><a href="/en/spring-security/servlet-saml2-login.html" class="sidebar-link">SAML 2.0 Login</a></li><li><a href="/en/spring-security/servlet-saml2-login-overview.html" class="sidebar-link">SAML 2.0 Login Overview</a></li><li><a href="/en/spring-security/servlet-saml2-login-authentication-requests.html" class="sidebar-link">Producing &lt;saml2:AuthnRequest&gt;s</a></li><li><a href="/en/spring-security/servlet-saml2-login-authentication.html" class="sidebar-link">Authenticating &lt;saml2:Response&gt;s</a></li><li><a href="/en/spring-security/servlet-saml2-logout.html" class="sidebar-link">Performing Single Logout</a></li><li><a href="/en/spring-security/servlet-saml2-metadata.html" class="sidebar-link">Producing &lt;saml2:SPSSODescriptor&gt; Metadata</a></li><li><a href="/en/spring-security/servlet-exploits.html" class="sidebar-link">Protection Against Exploits</a></li><li><a href="/en/spring-security/servlet-exploits-csrf.html" class="sidebar-link">Cross Site Request Forgery (CSRF) for Servlet Environments</a></li><li><a href="/en/spring-security/servlet-exploits-headers.html" class="sidebar-link">Security HTTP Response Headers</a></li><li><a href="/en/spring-security/servlet-exploits-http.html" class="sidebar-link">HTTP</a></li><li><a href="/en/spring-security/servlet-exploits-firewall.html" class="sidebar-link">HttpFirewall</a></li><li><a href="/en/spring-security/servlet-integrations.html" class="sidebar-link">Integrations</a></li><li><a href="/en/spring-security/servlet-integrations-concurrency.html" class="sidebar-link">Concurrency Support</a></li><li><a href="/en/spring-security/servlet-integrations-jackson.html" class="sidebar-link">Jackson Support</a></li><li><a href="/en/spring-security/servlet-integrations-localization.html" class="sidebar-link">Localization</a></li><li><a href="/en/spring-security/servlet-integrations-servlet-api.html" class="sidebar-link">Servlet API integration</a></li><li><a href="/en/spring-security/servlet-integrations-data.html" class="sidebar-link">Spring Data Integration</a></li><li><a href="/en/spring-security/servlet-integrations-mvc.html" class="sidebar-link">Spring MVC Integration</a></li><li><a href="/en/spring-security/servlet-integrations-websocket.html" class="sidebar-link">WebSocket Security</a></li><li><a href="/en/spring-security/servlet-integrations-cors.html" class="sidebar-link">CORS</a></li><li><a href="/en/spring-security/servlet-integrations-jsp-taglibs.html" class="sidebar-link">JSP Tag Libraries</a></li><li><a href="/en/spring-security/servlet-configuration-java.html" class="sidebar-link">Java Configuration</a></li><li><a href="/en/spring-security/servlet-configuration-kotlin.html" class="sidebar-link">Kotlin Configuration</a></li><li><a href="/en/spring-security/servlet-configuration-xml-namespace.html" class="sidebar-link">Security Namespace Configuration</a></li><li><a href="/en/spring-security/servlet-test.html" class="sidebar-link">Testing</a></li><li><a href="/en/spring-security/servlet-test-method.html" class="sidebar-link">Testing Method Security</a></li><li><a href="/en/spring-security/servlet-test-mockmvc.html" class="sidebar-link">Spring MVC Test Integration</a></li><li><a href="/en/spring-security/servlet-test-mockmvc-setup.html" class="sidebar-link">Setting Up MockMvc and Spring Security</a></li><li><a href="/en/spring-security/servlet-test-mockmvc-request-post-processors.html" class="sidebar-link">SecurityMockMvcRequestPostProcessors</a></li><li><a href="/en/spring-security/servlet-test-mockmvc-authentication.html" class="sidebar-link">Running a Test as a User in Spring MVC Test</a></li><li><a href="/en/spring-security/servlet-test-mockmvc-csrf.html" class="sidebar-link">Testing with CSRF Protection</a></li><li><a href="/en/spring-security/servlet-test-mockmvc-form-login.html" class="sidebar-link">Testing Form Based Authentication</a></li><li><a href="/en/spring-security/servlet-test-mockmvc-http-basic.html" class="sidebar-link">Testing HTTP Basic Authentication</a></li><li><a href="/en/spring-security/servlet-test-mockmvc-oauth2.html" class="sidebar-link">Testing OAuth 2.0</a></li><li><a href="/en/spring-security/servlet-test-mockmvc-logout.html" class="sidebar-link">Testing Logout</a></li><li><a href="/en/spring-security/servlet-test-mockmvc-request-builders.html" class="sidebar-link">SecurityMockMvcRequestBuilders</a></li><li><a href="/en/spring-security/servlet-test-mockmvc-result-matchers.html" class="sidebar-link">SecurityMockMvcResultMatchers</a></li><li><a href="/en/spring-security/servlet-test-mockmvc-result-handlers.html" class="sidebar-link">SecurityMockMvcResultHandlers</a></li><li><a href="/en/spring-security/servlet-appendix.html" class="sidebar-link">Appendix</a></li><li><a href="/en/spring-security/servlet-appendix-database-schema.html" class="sidebar-link">Security Database Schema</a></li><li><a href="/en/spring-security/servlet-appendix-namespace.html" class="sidebar-link">The Security Namespace</a></li><li><a href="/en/spring-security/servlet-appendix-namespace-authentication-manager.html" class="sidebar-link">Authentication Services</a></li><li><a href="/en/spring-security/servlet-appendix-namespace-http.html" class="sidebar-link">Web Application Security</a></li><li><a href="/en/spring-security/servlet-appendix-namespace-method-security.html" class="sidebar-link">Method Security</a></li><li><a href="/en/spring-security/servlet-appendix-namespace-ldap.html" class="sidebar-link">LDAP Namespace Options</a></li><li><a href="/en/spring-security/servlet-appendix-namespace-websocket.html" class="sidebar-link">WebSocket Security</a></li><li><a href="/en/spring-security/servlet-appendix-faq.html" class="sidebar-link">Spring Security FAQ</a></li><li><a href="/en/spring-security/reactive.html" class="sidebar-link">Reactive Applications</a></li><li><a href="/en/spring-security/reactive-getting-started.html" class="sidebar-link">Getting Started with WebFlux Applications</a></li><li><a href="/en/spring-security/reactive-authentication-x509.html" class="sidebar-link">Reactive X.509 Authentication</a></li><li><a href="/en/spring-security/reactive-authentication-logout.html" class="sidebar-link">Logout</a></li><li><a href="/en/spring-security/reactive-authorization-authorize-http-requests.html" class="sidebar-link">Authorize ServerHttpRequest</a></li><li><a href="/en/spring-security/reactive-authorization-method.html" class="sidebar-link">EnableReactiveMethodSecurity</a></li><li><a href="/en/spring-security/reactive-oauth2.html" class="sidebar-link">OAuth2 WebFlux</a></li><li><a href="/en/spring-security/reactive-oauth2-login.html" class="sidebar-link">OAuth 2.0 Login</a></li><li><a href="/en/spring-security/reactive-oauth2-login-core.html" class="sidebar-link">Core Configuration</a></li><li><a href="/en/spring-security/reactive-oauth2-login-advanced.html" class="sidebar-link">Advanced Configuration</a></li><li><a href="/en/spring-security/reactive-oauth2-client.html" class="sidebar-link">OAuth 2.0 Client</a></li><li><a href="/en/spring-security/reactive-oauth2-client-core.html" class="sidebar-link">Core Interfaces / Classes</a></li><li><a href="/en/spring-security/reactive-oauth2-client-authorization-grants.html" class="sidebar-link">Authorization Grant Support</a></li><li><a href="/en/spring-security/reactive-oauth2-client-client-authentication.html" class="sidebar-link">Client Authentication Support</a></li><li><a href="/en/spring-security/reactive-oauth2-client-authorized-clients.html" class="sidebar-link">Authorized Clients</a></li><li><a href="/en/spring-security/reactive-oauth2-resource-server.html" class="sidebar-link">OAuth 2.0 Resource Server</a></li><li><a href="/en/spring-security/reactive-oauth2-resource-server-jwt.html" class="sidebar-link">OAuth 2.0 Resource Server JWT</a></li><li><a href="/en/spring-security/reactive-oauth2-resource-server-opaque-token.html" class="sidebar-link">OAuth 2.0 Resource Server Opaque Token</a></li><li><a href="/en/spring-security/reactive-oauth2-resource-server-multitenancy.html" class="sidebar-link">OAuth 2.0 Resource Server Multitenancy</a></li><li><a href="/en/spring-security/reactive-oauth2-resource-server-bearer-tokens.html" class="sidebar-link">OAuth 2.0 Resource Server Bearer Tokens</a></li><li><a href="/en/spring-security/reactive-exploits.html" class="sidebar-link">Protection Against Exploits</a></li><li><a href="/en/spring-security/reactive-exploits-csrf.html" class="sidebar-link">Cross Site Request Forgery (CSRF) for WebFlux Environments</a></li><li><a href="/en/spring-security/reactive-exploits-headers.html" class="sidebar-link">Security HTTP Response Headers</a></li><li><a href="/en/spring-security/reactive-exploits-http.html" class="sidebar-link">HTTP</a></li><li><a href="/en/spring-security/reactive-integrations-cors.html" class="sidebar-link">CORS</a></li><li><a href="/en/spring-security/reactive-integrations-rsocket.html" class="sidebar-link">RSocket Security</a></li><li><a href="/en/spring-security/reactive-test.html" class="sidebar-link">Reactive Test Support</a></li><li><a href="/en/spring-security/reactive-test-method.html" class="sidebar-link">Testing Method Security</a></li><li><a href="/en/spring-security/reactive-test-web.html" class="sidebar-link">Testing Web Security</a></li><li><a href="/en/spring-security/reactive-test-web-setup.html" class="sidebar-link">WebTestClient Security Setup</a></li><li><a href="/en/spring-security/reactive-test-web-authentication.html" class="sidebar-link">Testing Authentication</a></li><li><a href="/en/spring-security/reactive-test-web-csrf.html" class="sidebar-link">Testing with CSRF</a></li><li><a href="/en/spring-security/reactive-test-web-oauth2.html" class="sidebar-link">Testing OAuth 2.0</a></li><li><a href="/en/spring-security/reactive-configuration-webflux.html" class="sidebar-link">WebFlux Security</a></li></ul></section></li></ul> </aside> <main class="page"> <div class="theme-default-content content__default"><h1 id="password-storage"><a href="#password-storage" class="header-anchor">#</a> Password Storage</h1> <p>Spring Security’s <code>PasswordEncoder</code> interface is used to perform a one way transformation of a password to allow the password to be stored securely.
Given <code>PasswordEncoder</code> is a one way transformation, it is not intended when the password transformation needs to be two way (i.e. storing credentials used to authenticate to a database).
Typically <code>PasswordEncoder</code> is used for storing a password that needs to be compared to a user provided password at the time of authentication.</p> <h2 id="password-storage-history"><a href="#password-storage-history" class="header-anchor">#</a> Password Storage History</h2> <p>Throughout the years the standard mechanism for storing passwords has evolved.
In the beginning passwords were stored in plain text.
The passwords were assumed to be safe because the data store the passwords were saved in required credentials to access it.
However, malicious users were able to find ways to get large &quot;data dumps&quot; of usernames and passwords using attacks like SQL Injection.
As more and more user credentials became public security experts realized we needed to do more to protect users' passwords.</p> <p>Developers were then encouraged to store passwords after running them through a one way hash such as SHA-256.
When a user tried to authenticate, the hashed password would be compared to the hash of the password that they typed.
This meant that the system only needed to store the one way hash of the password.
If a breach occurred, then only the one way hashes of the passwords were exposed.
Since the hashes were one way and it was computationally difficult to guess the passwords given the hash, it would not be worth the effort to figure out each password in the system.
To defeat this new system malicious users decided to create lookup tables known as <a href="https://en.wikipedia.org/wiki/Rainbow_table" target="_blank" rel="noopener noreferrer">Rainbow Tables<span><svg xmlns="http://www.w3.org/2000/svg" aria-hidden="true" focusable="false" x="0px" y="0px" viewBox="0 0 100 100" width="15" height="15" class="icon outbound"><path fill="currentColor" d="M18.8,85.1h56l0,0c2.2,0,4-1.8,4-4v-32h-8v28h-48v-48h28v-8h-32l0,0c-2.2,0-4,1.8-4,4v56C14.8,83.3,16.6,85.1,18.8,85.1z"></path> <polygon fill="currentColor" points="45.7,48.7 51.3,54.3 77.2,28.5 77.2,37.2 85.2,37.2 85.2,14.9 62.8,14.9 62.8,22.9 71.5,22.9"></polygon></svg> <span class="sr-only">(opens new window)</span></span></a>.
Rather than doing the work of guessing each password every time, they computed the password once and stored it in a lookup table.</p> <p>To mitigate the effectiveness of Rainbow Tables, developers were encouraged to use salted passwords.
Instead of using just the password as input to the hash function, random bytes (known as salt) would be generated for every users' password.
The salt and the user’s password would be ran through the hash function which produced a unique hash.
The salt would be stored alongside the user’s password in clear text.
Then when a user tried to authenticate, the hashed password would be compared to the hash of the stored salt and the password that they typed.
The unique salt meant that Rainbow Tables were no longer effective because the hash was different for every salt and password combination.</p> <p>In modern times we realize that cryptographic hashes (like SHA-256) are no longer secure.
The reason is that with modern hardware we can perform billions of hash calculations a second.
This means that we can crack each password individually with ease.</p> <p>Developers are now encouraged to leverage adaptive one-way functions to store a password.
Validation of passwords with adaptive one-way functions are intentionally resource (i.e. CPU, memory, etc) intensive.
An adaptive one-way function allows configuring a &quot;work factor&quot; which can grow as hardware gets better.
It is recommended that the &quot;work factor&quot; be tuned to take about 1 second to verify a password on your system.
This trade off is to make it difficult for attackers to crack the password, but not so costly it puts excessive burden on your own system.
Spring Security has attempted to provide a good starting point for the &quot;work factor&quot;, but users are encouraged to customize the &quot;work factor&quot; for their own system since the performance will vary drastically from system to system.
Examples of adaptive one-way functions that should be used include <a href="#authentication-password-storage-bcrypt">bcrypt</a>, <a href="#authentication-password-storage-pbkdf2">PBKDF2</a>, <a href="#authentication-password-storage-scrypt">scrypt</a>, and <a href="#authentication-password-storage-argon2">argon2</a>.</p> <p>Because adaptive one-way functions are intentionally resource intensive, validating a username and password for every request will degrade performance of an application significantly.
There is nothing Spring Security (or any other library) can do to speed up the validation of the password since security is gained by making the validation resource intensive.
Users are encouraged to exchange the long term credentials (i.e. username and password) for a short term credential (i.e. session, OAuth Token, etc).
The short term credential can be validated quickly without any loss in security.</p> <h2 id="delegatingpasswordencoder"><a href="#delegatingpasswordencoder" class="header-anchor">#</a> DelegatingPasswordEncoder</h2> <p>Prior to Spring Security 5.0 the default <code>PasswordEncoder</code> was <code>NoOpPasswordEncoder</code> which required plain text passwords.
Based upon the <a href="#authentication-password-storage-history">Password History</a> section you might expect that the default <code>PasswordEncoder</code> is now something like <code>BCryptPasswordEncoder</code>.
However, this ignores three real world problems:</p> <ul><li><p>There are many applications using old password encodings that cannot easily migrate</p></li> <li><p>The best practice for password storage will change again</p></li> <li><p>As a framework Spring Security cannot make breaking changes frequently</p></li></ul> <p>Instead Spring Security introduces <code>DelegatingPasswordEncoder</code> which solves all of the problems by:</p> <ul><li><p>Ensuring that passwords are encoded using the current password storage recommendations</p></li> <li><p>Allowing for validating passwords in modern and legacy formats</p></li> <li><p>Allowing for upgrading the encoding in the future</p></li></ul> <p>You can easily construct an instance of <code>DelegatingPasswordEncoder</code> using <code>PasswordEncoderFactories</code>.</p> <p>Example 1. Create Default DelegatingPasswordEncoder</p> <p>Java</p> <div class="language- extra-class"><pre class="language-text"><code>PasswordEncoder passwordEncoder =
    PasswordEncoderFactories.createDelegatingPasswordEncoder();
</code></pre></div><p>Kotlin</p> <div class="language- extra-class"><pre class="language-text"><code>val passwordEncoder: PasswordEncoder = PasswordEncoderFactories.createDelegatingPasswordEncoder()
</code></pre></div><p>Alternatively, you may create your own custom instance. For example:</p> <p>Example 2. Create Custom DelegatingPasswordEncoder</p> <p>Java</p> <div class="language- extra-class"><pre class="language-text"><code>String idForEncode = &quot;bcrypt&quot;;
Map encoders = new HashMap&lt;&gt;();
encoders.put(idForEncode, new BCryptPasswordEncoder());
encoders.put(&quot;noop&quot;, NoOpPasswordEncoder.getInstance());
encoders.put(&quot;pbkdf2&quot;, new Pbkdf2PasswordEncoder());
encoders.put(&quot;scrypt&quot;, new SCryptPasswordEncoder());
encoders.put(&quot;sha256&quot;, new StandardPasswordEncoder());

PasswordEncoder passwordEncoder =
    new DelegatingPasswordEncoder(idForEncode, encoders);
</code></pre></div><p>Kotlin</p> <div class="language- extra-class"><pre class="language-text"><code>val idForEncode = &quot;bcrypt&quot;
val encoders: MutableMap&lt;String, PasswordEncoder&gt; = mutableMapOf()
encoders[idForEncode] = BCryptPasswordEncoder()
encoders[&quot;noop&quot;] = NoOpPasswordEncoder.getInstance()
encoders[&quot;pbkdf2&quot;] = Pbkdf2PasswordEncoder()
encoders[&quot;scrypt&quot;] = SCryptPasswordEncoder()
encoders[&quot;sha256&quot;] = StandardPasswordEncoder()

val passwordEncoder: PasswordEncoder = DelegatingPasswordEncoder(idForEncode, encoders)
</code></pre></div><h3 id="password-storage-format"><a href="#password-storage-format" class="header-anchor">#</a> Password Storage Format</h3> <p>The general format for a password is:</p> <p>Example 3. DelegatingPasswordEncoder Storage Format</p> <div class="language- extra-class"><pre class="language-text"><code>{id}encodedPassword
</code></pre></div><p>Such that <code>id</code> is an identifier used to look up which <code>PasswordEncoder</code> should be used and <code>encodedPassword</code> is the original encoded password for the selected <code>PasswordEncoder</code>.
The <code>id</code> must be at the beginning of the password, start with <code>{</code> and end with <code>}</code>.
If the <code>id</code> cannot be found, the <code>id</code> will be null.
For example, the following might be a list of passwords encoded using different <code>id</code>.
All of the original passwords are &quot;password&quot;.</p> <p>Example 4. DelegatingPasswordEncoder Encoded Passwords Example</p> <div class="language- extra-class"><pre class="language-text"><code>{bcrypt}$2a$10$dXJ3SW6G7P50lGmMkkmwe.20cQQubK3.HZWzG3YB1tlRy.fqvM/BG (1)
{noop}password (2)
{pbkdf2}5d923b44a6d129f3ddf3e3c8d29412723dcbde72445e8ef6bf3b508fbf17fa4ed4d6b99ca763d8dc (3)
{scrypt}$e0801$8bWJaSu2IKSn9Z9kM+TPXfOc/9bdYSrN1oD9qfVThWEwdRTnO7re7Ei+fUZRJ68k9lTyuTeUp4of4g24hHnazw==$OAOec05+bXxvuu/1qZ6NUR+xQYvYv7BeL1QxwRpY5Pc=  (4)
{sha256}97cde38028ad898ebc02e690819fa220e88c62e0699403e94fff291cfffaf8410849f27605abcbc0 (5)
</code></pre></div><table><thead><tr><th><strong>1</strong></th> <th>The first password would have a <code>PasswordEncoder</code> id of <code>bcrypt</code> and encodedPassword of <code>$2a$10$dXJ3SW6G7P50lGmMkkmwe.20cQQubK3.HZWzG3YB1tlRy.fqvM/BG</code>.<br>When matching it would delegate to <code>BCryptPasswordEncoder</code></th></tr></thead> <tbody><tr><td><strong>2</strong></td> <td>The second password would have a <code>PasswordEncoder</code> id of <code>noop</code> and encodedPassword of <code>password</code>.<br>When matching it would delegate to <code>NoOpPasswordEncoder</code></td></tr> <tr><td><strong>3</strong></td> <td>The third password would have a <code>PasswordEncoder</code> id of <code>pbkdf2</code> and encodedPassword of <code>5d923b44a6d129f3ddf3e3c8d29412723dcbde72445e8ef6bf3b508fbf17fa4ed4d6b99ca763d8dc</code>.<br>When matching it would delegate to <code>Pbkdf2PasswordEncoder</code></td></tr> <tr><td><strong>4</strong></td> <td>The fourth password would have a <code>PasswordEncoder</code> id of <code>scrypt</code> and encodedPassword of <code>$e0801$8bWJaSu2IKSn9Z9kM+TPXfOc/9bdYSrN1oD9qfVThWEwdRTnO7re7Ei+fUZRJ68k9lTyuTeUp4of4g24hHnazw==$OAOec05+bXxvuu/1qZ6NUR+xQYvYv7BeL1QxwRpY5Pc=</code>When matching it would delegate to <code>SCryptPasswordEncoder</code></td></tr> <tr><td><strong>5</strong></td> <td>The final password would have a <code>PasswordEncoder</code> id of <code>sha256</code> and encodedPassword of <code>97cde38028ad898ebc02e690819fa220e88c62e0699403e94fff291cfffaf8410849f27605abcbc0</code>.<br>When matching it would delegate to <code>StandardPasswordEncoder</code></td></tr></tbody></table> <table><thead><tr><th></th> <th>Some users might be concerned that the storage format is provided for a potential hacker.<br>This is not a concern because the storage of the password does not rely on the algorithm being a secret.<br>Additionally, most formats are easy for an attacker to figure out without the prefix.<br>For example, BCrypt passwords often start with <code>$2a$</code>.</th></tr></thead> <tbody></tbody></table> <h3 id="password-encoding"><a href="#password-encoding" class="header-anchor">#</a> Password Encoding</h3> <p>The <code>idForEncode</code> passed into the constructor determines which <code>PasswordEncoder</code> will be used for encoding passwords.
In the <code>DelegatingPasswordEncoder</code> we constructed above, that means that the result of encoding <code>password</code> would be delegated to <code>BCryptPasswordEncoder</code> and be prefixed with <code>{bcrypt}</code>.
The end result would look like:</p> <p>Example 5. DelegatingPasswordEncoder Encode Example</p> <div class="language- extra-class"><pre class="language-text"><code>{bcrypt}$2a$10$dXJ3SW6G7P50lGmMkkmwe.20cQQubK3.HZWzG3YB1tlRy.fqvM/BG
</code></pre></div><h3 id="password-matching"><a href="#password-matching" class="header-anchor">#</a> Password Matching</h3> <p>Matching is done based upon the <code>{id}</code> and the mapping of the <code>id</code> to the <code>PasswordEncoder</code> provided in the constructor.
Our example in <a href="#authentication-password-storage-dpe-format">Password Storage Format</a> provides a working example of how this is done.
By default, the result of invoking <code>matches(CharSequence, String)</code> with a password and an <code>id</code> that is not mapped (including a null id) will result in an <code>IllegalArgumentException</code>.
This behavior can be customized using <code>DelegatingPasswordEncoder.setDefaultPasswordEncoderForMatches(PasswordEncoder)</code>.</p> <p>By using the <code>id</code> we can match on any password encoding, but encode passwords using the most modern password encoding.
This is important, because unlike encryption, password hashes are designed so that there is no simple way to recover the plaintext.
Since there is no way to recover the plaintext, it makes it difficult to migrate the passwords.
While it is simple for users to migrate <code>NoOpPasswordEncoder</code>, we chose to include it by default to make it simple for the getting started experience.</p> <h3 id="getting-started-experience"><a href="#getting-started-experience" class="header-anchor">#</a> Getting Started Experience</h3> <p>If you are putting together a demo or a sample, it is a bit cumbersome to take time to hash the passwords of your users.
There are convenience mechanisms to make this easier, but this is still not intended for production.</p> <p>Example 6. withDefaultPasswordEncoder Example</p> <p>Java</p> <div class="language- extra-class"><pre class="language-text"><code>User user = User.withDefaultPasswordEncoder()
  .username(&quot;user&quot;)
  .password(&quot;password&quot;)
  .roles(&quot;user&quot;)
  .build();
System.out.println(user.getPassword());
// {bcrypt}$2a$10$dXJ3SW6G7P50lGmMkkmwe.20cQQubK3.HZWzG3YB1tlRy.fqvM/BG
</code></pre></div><p>Kotlin</p> <div class="language- extra-class"><pre class="language-text"><code>val user = User.withDefaultPasswordEncoder()
    .username(&quot;user&quot;)
    .password(&quot;password&quot;)
    .roles(&quot;user&quot;)
    .build()
println(user.password)
// {bcrypt}$2a$10$dXJ3SW6G7P50lGmMkkmwe.20cQQubK3.HZWzG3YB1tlRy.fqvM/BG
</code></pre></div><p>If you are creating multiple users, you can also reuse the builder.</p> <p>Example 7. withDefaultPasswordEncoder Reusing the Builder</p> <p>Java</p> <div class="language- extra-class"><pre class="language-text"><code>UserBuilder users = User.withDefaultPasswordEncoder();
User user = users
  .username(&quot;user&quot;)
  .password(&quot;password&quot;)
  .roles(&quot;USER&quot;)
  .build();
User admin = users
  .username(&quot;admin&quot;)
  .password(&quot;password&quot;)
  .roles(&quot;USER&quot;,&quot;ADMIN&quot;)
  .build();
</code></pre></div><p>Kotlin</p> <div class="language- extra-class"><pre class="language-text"><code>val users = User.withDefaultPasswordEncoder()
val user = users
    .username(&quot;user&quot;)
    .password(&quot;password&quot;)
    .roles(&quot;USER&quot;)
    .build()
val admin = users
    .username(&quot;admin&quot;)
    .password(&quot;password&quot;)
    .roles(&quot;USER&quot;, &quot;ADMIN&quot;)
    .build()
</code></pre></div><p>This does hash the password that is stored, but the passwords are still exposed in memory and in the compiled source code.
Therefore, it is still not considered secure for a production environment.
For production, you should <a href="#authentication-password-storage-boot-cli">hash your passwords externally</a>.</p> <h3 id="encode-with-spring-boot-cli"><a href="#encode-with-spring-boot-cli" class="header-anchor">#</a> Encode with Spring Boot CLI</h3> <p>The easiest way to properly encode your password is to use the <a href="https://docs.spring.io/spring-boot/docs/current/reference/html/spring-boot-cli.html" target="_blank" rel="noopener noreferrer">Spring Boot CLI<span><svg xmlns="http://www.w3.org/2000/svg" aria-hidden="true" focusable="false" x="0px" y="0px" viewBox="0 0 100 100" width="15" height="15" class="icon outbound"><path fill="currentColor" d="M18.8,85.1h56l0,0c2.2,0,4-1.8,4-4v-32h-8v28h-48v-48h28v-8h-32l0,0c-2.2,0-4,1.8-4,4v56C14.8,83.3,16.6,85.1,18.8,85.1z"></path> <polygon fill="currentColor" points="45.7,48.7 51.3,54.3 77.2,28.5 77.2,37.2 85.2,37.2 85.2,14.9 62.8,14.9 62.8,22.9 71.5,22.9"></polygon></svg> <span class="sr-only">(opens new window)</span></span></a>.</p> <p>For example, the following will encode the password of <code>password</code> for use with <a href="#authentication-password-storage-dpe">DelegatingPasswordEncoder</a>:</p> <p>Example 8. Spring Boot CLI encodepassword Example</p> <div class="language- extra-class"><pre class="language-text"><code>spring encodepassword password
{bcrypt}$2a$10$X5wFBtLrL/kHcmrOGGTrGufsBX8CJ0WpQpF3pgeuxBB/H73BK1DW6
</code></pre></div><h3 id="troubleshooting"><a href="#troubleshooting" class="header-anchor">#</a> Troubleshooting</h3> <p>The following error occurs when one of the passwords that are stored has no id as described in <a href="#authentication-password-storage-dpe-format">Password Storage Format</a>.</p> <div class="language- extra-class"><pre class="language-text"><code>java.lang.IllegalArgumentException: There is no PasswordEncoder mapped for the id &quot;null&quot;
	at org.springframework.security.crypto.password.DelegatingPasswordEncoder$UnmappedIdPasswordEncoder.matches(DelegatingPasswordEncoder.java:233)
	at org.springframework.security.crypto.password.DelegatingPasswordEncoder.matches(DelegatingPasswordEncoder.java:196)
</code></pre></div><p>The easiest way to resolve the error is to switch to explicitly providing the <code>PasswordEncoder</code> that your passwords are encoded with.
The easiest way to resolve it is to figure out how your passwords are currently being stored and explicitly provide the correct <code>PasswordEncoder</code>.</p> <p>If you are migrating from Spring Security 4.2.x you can revert to the previous behavior by <a href="#authentication-password-storage-configuration">exposing a <code>NoOpPasswordEncoder</code> bean</a>.</p> <p>Alternatively, you can prefix all of your passwords with the correct id and continue to use <code>DelegatingPasswordEncoder</code>.
For example, if you are using BCrypt, you would migrate your password from something like:</p> <div class="language- extra-class"><pre class="language-text"><code>$2a$10$dXJ3SW6G7P50lGmMkkmwe.20cQQubK3.HZWzG3YB1tlRy.fqvM/BG
</code></pre></div><p>to</p> <div class="language- extra-class"><pre class="language-text"><code>{bcrypt}$2a$10$dXJ3SW6G7P50lGmMkkmwe.20cQQubK3.HZWzG3YB1tlRy.fqvM/BG
</code></pre></div><p>For a complete listing of the mappings refer to the Javadoc on<a href="https://docs.spring.io/spring-security/site/docs/5.0.x/api/org/springframework/security/crypto/factory/PasswordEncoderFactories.html" target="_blank" rel="noopener noreferrer">PasswordEncoderFactories<span><svg xmlns="http://www.w3.org/2000/svg" aria-hidden="true" focusable="false" x="0px" y="0px" viewBox="0 0 100 100" width="15" height="15" class="icon outbound"><path fill="currentColor" d="M18.8,85.1h56l0,0c2.2,0,4-1.8,4-4v-32h-8v28h-48v-48h28v-8h-32l0,0c-2.2,0-4,1.8-4,4v56C14.8,83.3,16.6,85.1,18.8,85.1z"></path> <polygon fill="currentColor" points="45.7,48.7 51.3,54.3 77.2,28.5 77.2,37.2 85.2,37.2 85.2,14.9 62.8,14.9 62.8,22.9 71.5,22.9"></polygon></svg> <span class="sr-only">(opens new window)</span></span></a>.</p> <h2 id="bcryptpasswordencoder"><a href="#bcryptpasswordencoder" class="header-anchor">#</a> BCryptPasswordEncoder</h2> <p>The <code>BCryptPasswordEncoder</code> implementation uses the widely supported <a href="https://en.wikipedia.org/wiki/Bcrypt" target="_blank" rel="noopener noreferrer">bcrypt<span><svg xmlns="http://www.w3.org/2000/svg" aria-hidden="true" focusable="false" x="0px" y="0px" viewBox="0 0 100 100" width="15" height="15" class="icon outbound"><path fill="currentColor" d="M18.8,85.1h56l0,0c2.2,0,4-1.8,4-4v-32h-8v28h-48v-48h28v-8h-32l0,0c-2.2,0-4,1.8-4,4v56C14.8,83.3,16.6,85.1,18.8,85.1z"></path> <polygon fill="currentColor" points="45.7,48.7 51.3,54.3 77.2,28.5 77.2,37.2 85.2,37.2 85.2,14.9 62.8,14.9 62.8,22.9 71.5,22.9"></polygon></svg> <span class="sr-only">(opens new window)</span></span></a> algorithm to hash the passwords.
In order to make it more resistent to password cracking, bcrypt is deliberately slow.
Like other adaptive one-way functions, it should be tuned to take about 1 second to verify a password on your system.
The default implementation of <code>BCryptPasswordEncoder</code> uses strength 10 as mentioned in the Javadoc of <a href="https://docs.spring.io/spring-security/site/docs/current/api/org/springframework/security/crypto/bcrypt/BCryptPasswordEncoder.html" target="_blank" rel="noopener noreferrer">BCryptPasswordEncoder<span><svg xmlns="http://www.w3.org/2000/svg" aria-hidden="true" focusable="false" x="0px" y="0px" viewBox="0 0 100 100" width="15" height="15" class="icon outbound"><path fill="currentColor" d="M18.8,85.1h56l0,0c2.2,0,4-1.8,4-4v-32h-8v28h-48v-48h28v-8h-32l0,0c-2.2,0-4,1.8-4,4v56C14.8,83.3,16.6,85.1,18.8,85.1z"></path> <polygon fill="currentColor" points="45.7,48.7 51.3,54.3 77.2,28.5 77.2,37.2 85.2,37.2 85.2,14.9 62.8,14.9 62.8,22.9 71.5,22.9"></polygon></svg> <span class="sr-only">(opens new window)</span></span></a>. You are encouraged to
tune and test the strength parameter on your own system so that it takes roughly 1 second to verify a password.</p> <p>Example 9. BCryptPasswordEncoder</p> <p>Java</p> <div class="language- extra-class"><pre class="language-text"><code>// Create an encoder with strength 16
BCryptPasswordEncoder encoder = new BCryptPasswordEncoder(16);
String result = encoder.encode(&quot;myPassword&quot;);
assertTrue(encoder.matches(&quot;myPassword&quot;, result));
</code></pre></div><p>Kotlin</p> <div class="language- extra-class"><pre class="language-text"><code>// Create an encoder with strength 16
val encoder = BCryptPasswordEncoder(16)
val result: String = encoder.encode(&quot;myPassword&quot;)
assertTrue(encoder.matches(&quot;myPassword&quot;, result))
</code></pre></div><h2 id="argon2passwordencoder"><a href="#argon2passwordencoder" class="header-anchor">#</a> Argon2PasswordEncoder</h2> <p>The <code>Argon2PasswordEncoder</code> implementation uses the <a href="https://en.wikipedia.org/wiki/Argon2" target="_blank" rel="noopener noreferrer">Argon2<span><svg xmlns="http://www.w3.org/2000/svg" aria-hidden="true" focusable="false" x="0px" y="0px" viewBox="0 0 100 100" width="15" height="15" class="icon outbound"><path fill="currentColor" d="M18.8,85.1h56l0,0c2.2,0,4-1.8,4-4v-32h-8v28h-48v-48h28v-8h-32l0,0c-2.2,0-4,1.8-4,4v56C14.8,83.3,16.6,85.1,18.8,85.1z"></path> <polygon fill="currentColor" points="45.7,48.7 51.3,54.3 77.2,28.5 77.2,37.2 85.2,37.2 85.2,14.9 62.8,14.9 62.8,22.9 71.5,22.9"></polygon></svg> <span class="sr-only">(opens new window)</span></span></a> algorithm to hash the passwords.
Argon2 is the winner of the <a href="https://en.wikipedia.org/wiki/Password_Hashing_Competition" target="_blank" rel="noopener noreferrer">Password Hashing Competition<span><svg xmlns="http://www.w3.org/2000/svg" aria-hidden="true" focusable="false" x="0px" y="0px" viewBox="0 0 100 100" width="15" height="15" class="icon outbound"><path fill="currentColor" d="M18.8,85.1h56l0,0c2.2,0,4-1.8,4-4v-32h-8v28h-48v-48h28v-8h-32l0,0c-2.2,0-4,1.8-4,4v56C14.8,83.3,16.6,85.1,18.8,85.1z"></path> <polygon fill="currentColor" points="45.7,48.7 51.3,54.3 77.2,28.5 77.2,37.2 85.2,37.2 85.2,14.9 62.8,14.9 62.8,22.9 71.5,22.9"></polygon></svg> <span class="sr-only">(opens new window)</span></span></a>.
In order to defeat password cracking on custom hardware, Argon2 is a deliberately slow algorithm that requires large amounts of memory.
Like other adaptive one-way functions, it should be tuned to take about 1 second to verify a password on your system.
The current implementation of the <code>Argon2PasswordEncoder</code> requires BouncyCastle.</p> <p>Example 10. Argon2PasswordEncoder</p> <p>Java</p> <div class="language- extra-class"><pre class="language-text"><code>// Create an encoder with all the defaults
Argon2PasswordEncoder encoder = new Argon2PasswordEncoder();
String result = encoder.encode(&quot;myPassword&quot;);
assertTrue(encoder.matches(&quot;myPassword&quot;, result));
</code></pre></div><p>Kotlin</p> <div class="language- extra-class"><pre class="language-text"><code>// Create an encoder with all the defaults
val encoder = Argon2PasswordEncoder()
val result: String = encoder.encode(&quot;myPassword&quot;)
assertTrue(encoder.matches(&quot;myPassword&quot;, result))
</code></pre></div><h2 id="pbkdf2passwordencoder"><a href="#pbkdf2passwordencoder" class="header-anchor">#</a> Pbkdf2PasswordEncoder</h2> <p>The <code>Pbkdf2PasswordEncoder</code> implementation uses the <a href="https://en.wikipedia.org/wiki/PBKDF2" target="_blank" rel="noopener noreferrer">PBKDF2<span><svg xmlns="http://www.w3.org/2000/svg" aria-hidden="true" focusable="false" x="0px" y="0px" viewBox="0 0 100 100" width="15" height="15" class="icon outbound"><path fill="currentColor" d="M18.8,85.1h56l0,0c2.2,0,4-1.8,4-4v-32h-8v28h-48v-48h28v-8h-32l0,0c-2.2,0-4,1.8-4,4v56C14.8,83.3,16.6,85.1,18.8,85.1z"></path> <polygon fill="currentColor" points="45.7,48.7 51.3,54.3 77.2,28.5 77.2,37.2 85.2,37.2 85.2,14.9 62.8,14.9 62.8,22.9 71.5,22.9"></polygon></svg> <span class="sr-only">(opens new window)</span></span></a> algorithm to hash the passwords.
In order to defeat password cracking PBKDF2 is a deliberately slow algorithm.
Like other adaptive one-way functions, it should be tuned to take about 1 second to verify a password on your system.
This algorithm is a good choice when FIPS certification is required.</p> <p>Example 11. Pbkdf2PasswordEncoder</p> <p>Java</p> <div class="language- extra-class"><pre class="language-text"><code>// Create an encoder with all the defaults
Pbkdf2PasswordEncoder encoder = new Pbkdf2PasswordEncoder();
String result = encoder.encode(&quot;myPassword&quot;);
assertTrue(encoder.matches(&quot;myPassword&quot;, result));
</code></pre></div><p>Kotlin</p> <div class="language- extra-class"><pre class="language-text"><code>// Create an encoder with all the defaults
val encoder = Pbkdf2PasswordEncoder()
val result: String = encoder.encode(&quot;myPassword&quot;)
assertTrue(encoder.matches(&quot;myPassword&quot;, result))
</code></pre></div><h2 id="scryptpasswordencoder"><a href="#scryptpasswordencoder" class="header-anchor">#</a> SCryptPasswordEncoder</h2> <p>The <code>SCryptPasswordEncoder</code> implementation uses <a href="https://en.wikipedia.org/wiki/Scrypt" target="_blank" rel="noopener noreferrer">scrypt<span><svg xmlns="http://www.w3.org/2000/svg" aria-hidden="true" focusable="false" x="0px" y="0px" viewBox="0 0 100 100" width="15" height="15" class="icon outbound"><path fill="currentColor" d="M18.8,85.1h56l0,0c2.2,0,4-1.8,4-4v-32h-8v28h-48v-48h28v-8h-32l0,0c-2.2,0-4,1.8-4,4v56C14.8,83.3,16.6,85.1,18.8,85.1z"></path> <polygon fill="currentColor" points="45.7,48.7 51.3,54.3 77.2,28.5 77.2,37.2 85.2,37.2 85.2,14.9 62.8,14.9 62.8,22.9 71.5,22.9"></polygon></svg> <span class="sr-only">(opens new window)</span></span></a> algorithm to hash the passwords.
In order to defeat password cracking on custom hardware scrypt is a deliberately slow algorithm that requires large amounts of memory.
Like other adaptive one-way functions, it should be tuned to take about 1 second to verify a password on your system.</p> <p>Example 12. SCryptPasswordEncoder</p> <p>Java</p> <div class="language- extra-class"><pre class="language-text"><code>// Create an encoder with all the defaults
SCryptPasswordEncoder encoder = new SCryptPasswordEncoder();
String result = encoder.encode(&quot;myPassword&quot;);
assertTrue(encoder.matches(&quot;myPassword&quot;, result));
</code></pre></div><p>Kotlin</p> <div class="language- extra-class"><pre class="language-text"><code>// Create an encoder with all the defaults
val encoder = SCryptPasswordEncoder()
val result: String = encoder.encode(&quot;myPassword&quot;)
assertTrue(encoder.matches(&quot;myPassword&quot;, result))
</code></pre></div><h2 id="other-passwordencoders"><a href="#other-passwordencoders" class="header-anchor">#</a> Other PasswordEncoders</h2> <p>There are a significant number of other <code>PasswordEncoder</code> implementations that exist entirely for backward compatibility.
They are all deprecated to indicate that they are no longer considered secure.
However, there are no plans to remove them since it is difficult to migrate existing legacy systems.</p> <h2 id="password-storage-configuration"><a href="#password-storage-configuration" class="header-anchor">#</a> Password Storage Configuration</h2> <p>Spring Security uses <a href="#authentication-password-storage-dpe">DelegatingPasswordEncoder</a> by default.
However, this can be customized by exposing a <code>PasswordEncoder</code> as a Spring bean.</p> <p>If you are migrating from Spring Security 4.2.x you can revert to the previous behavior by exposing a <code>NoOpPasswordEncoder</code> bean.</p> <table><thead><tr><th></th> <th>Reverting to <code>NoOpPasswordEncoder</code> is not considered to be secure.<br>You should instead migrate to using <code>DelegatingPasswordEncoder</code> to support secure password encoding.</th></tr></thead> <tbody></tbody></table> <p>Example 13. NoOpPasswordEncoder</p> <p>Java</p> <div class="language- extra-class"><pre class="language-text"><code>@Bean
public static PasswordEncoder passwordEncoder() {
    return NoOpPasswordEncoder.getInstance();
}
</code></pre></div><p>XML</p> <div class="language- extra-class"><pre class="language-text"><code>&lt;b:bean id=&quot;passwordEncoder&quot;
        class=&quot;org.springframework.security.crypto.password.NoOpPasswordEncoder&quot; factory-method=&quot;getInstance&quot;/&gt;
</code></pre></div><p>Kotlin</p> <div class="language- extra-class"><pre class="language-text"><code>@Bean
fun passwordEncoder(): PasswordEncoder {
    return NoOpPasswordEncoder.getInstance();
}
</code></pre></div><table><thead><tr><th></th> <th>XML Configuration requires the <code>NoOpPasswordEncoder</code> bean name to be <code>passwordEncoder</code>.</th></tr></thead> <tbody></tbody></table> <h2 id="change-password-configuration"><a href="#change-password-configuration" class="header-anchor">#</a> Change Password Configuration</h2> <p>Most applications that allow a user to specify a password also require a feature for updating that password.</p> <p><a href="https://w3c.github.io/webappsec-change-password-url/" target="_blank" rel="noopener noreferrer">A Well-Know URL for Changing Passwords<span><svg xmlns="http://www.w3.org/2000/svg" aria-hidden="true" focusable="false" x="0px" y="0px" viewBox="0 0 100 100" width="15" height="15" class="icon outbound"><path fill="currentColor" d="M18.8,85.1h56l0,0c2.2,0,4-1.8,4-4v-32h-8v28h-48v-48h28v-8h-32l0,0c-2.2,0-4,1.8-4,4v56C14.8,83.3,16.6,85.1,18.8,85.1z"></path> <polygon fill="currentColor" points="45.7,48.7 51.3,54.3 77.2,28.5 77.2,37.2 85.2,37.2 85.2,14.9 62.8,14.9 62.8,22.9 71.5,22.9"></polygon></svg> <span class="sr-only">(opens new window)</span></span></a> indicates a mechanism by which password managers can discover the password update endpoint for a given application.</p> <p>You can configure Spring Security to provide this discovery endpoint.
For example, if the change password endpoint in your application is <code>/change-password</code>, then you can configure Spring Security like so:</p> <p>Example 14. Default Change Password Endpoint</p> <p>Java</p> <div class="language- extra-class"><pre class="language-text"><code>http
    .passwordManagement(Customizer.withDefaults())
</code></pre></div><p>XML</p> <div class="language- extra-class"><pre class="language-text"><code>&lt;sec:password-management/&gt;
</code></pre></div><p>Kotlin</p> <div class="language- extra-class"><pre class="language-text"><code>http {
    passwordManagement { }
}
</code></pre></div><p>Then, when a password manager navigates to <code>/.well-known/change-password</code> then Spring Security will redirect your endpoint, <code>/change-password</code>.</p> <p>Or, if your endpoint is something other than <code>/change-password</code>, you can also specify that like so:</p> <p>Example 15. Change Password Endpoint</p> <p>Java</p> <div class="language- extra-class"><pre class="language-text"><code>http
    .passwordManagement((management) -&gt; management
        .changePasswordPage(&quot;/update-password&quot;)
    )
</code></pre></div><p>XML</p> <div class="language- extra-class"><pre class="language-text"><code>&lt;sec:password-management change-password-page=&quot;/update-password&quot;/&gt;
</code></pre></div><p>Kotlin</p> <div class="language- extra-class"><pre class="language-text"><code>http {
    passwordManagement {
        changePasswordPage = &quot;/update-password&quot;
    }
}
</code></pre></div><p>With the above configuration, when a password manager navigates to <code>/.well-known/change-password</code>, then Spring Security will redirect to <code>/update-password</code>.</p></div> <footer class="page-edit"><div class="edit-link"><a href="https://gitcode.net/dev-cloud/spring-docs/-/blob/master/docs/en/spring-security/features-authentication-password-storage.md" target="_blank" rel="noopener noreferrer">Edit this page on GitCode</a> <span><svg xmlns="http://www.w3.org/2000/svg" aria-hidden="true" focusable="false" x="0px" y="0px" viewBox="0 0 100 100" width="15" height="15" class="icon outbound"><path fill="currentColor" d="M18.8,85.1h56l0,0c2.2,0,4-1.8,4-4v-32h-8v28h-48v-48h28v-8h-32l0,0c-2.2,0-4,1.8-4,4v56C14.8,83.3,16.6,85.1,18.8,85.1z"></path> <polygon fill="currentColor" points="45.7,48.7 51.3,54.3 77.2,28.5 77.2,37.2 85.2,37.2 85.2,14.9 62.8,14.9 62.8,22.9 71.5,22.9"></polygon></svg> <span class="sr-only">(opens new window)</span></span></div> <div class="last-updated"><span class="prefix">Last Updated:</span> <span class="time">Wed Mar 16 2022 18:27:04 GMT+0800</span></div></footer> <div class="page-nav"><p class="inner"><span class="prev">
      ←
      <a href="/en/spring-security/features-authentication.html" class="prev">
        Authentication
      </a></span> <span class="next"><a href="/en/spring-security/features-exploits.html">
        Protection Against Exploits
      </a>
      →
    </span></p></div> </main></div><div class="global-ui"></div></div>
    <script src="/assets/js/app.91a38a71.js" defer></script><script src="/assets/js/3.50918073.js" defer></script><script src="/assets/js/4.cd4c3ff4.js" defer></script><script src="/assets/js/166.0e4c049b.js" defer></script>
  </body>
</html>