What is DelegatingPasswordEncoder and why is it the Spring Security default?

It's a PasswordEncoder that stores an algorithm-identifying prefix (like {bcrypt} or {argon2}) alongside every hash, and picks the right underlying encoder when verifying. This lets an application support multiple hashing algorithms simultaneously — critical for migrating from an older/weaker algorithm to a newer one without breaking existing users' ability to log in with their current hash.