intermediatePassword Security: Encoding, Encryption & Hashing

What does CompromisedPasswordChecker protect against that PasswordEncoder doesn't?

PasswordEncoder only handles safely STORING and VERIFYING a password; it says nothing about whether the chosen password is inherently weak or already known to attackers. CompromisedPasswordChecker checks a candidate password (at registration/change time) against known breached-password datasets (via k-anonymity so the raw password isn't transmitted), letting you reject passwords like 'password123' even though they'd hash and store 'successfully' otherwise.

Ready to master this question?

Generate a complete walkthrough — background, the full answer in plain language, a working code example explained line by line, a real-world scenario, common mistakes, and how this same question gets asked in different ways.

Next Step

Continue to When would you write a custom AuthenticationProvider instead of relying on DaoAuthenticationProvider? →← Back to all Spring Security questions