java - Spring security or BCrypt algorithm which one is good for accounts like project? -

i using spring security hashing password.and safe ,because using spring security first time.

my code here

<security:http auto-config="true"> <security:intercept-url pattern="/welcome*" access="role_user" /> <security:form-login login-page="/login" default-target-url="/welcome" authentication-failure-url="/loginfailed" /> <security:logout logout-success-url="/logout" /> </security:http> authentication-failure-url="/loginfailed" /> <security:logout logout-success-url="/logout" /> </security:http>  <authentication-manager>   <authentication-provider> <password-encoder hash="sha" />  <user-service> <user name="k" password="7c4a8d09ca3762af61e59520943dc26494f8941b"  authorities="role_user" />  </user-service> </authentication-provider> </authentication-manager>  

.and havnt used bcrypt algorithm.what feedback both?any recommendation?

just adding on serge's answer,

you can configure authenticationprovider automatically use bcrypt declaring password encoder bean this:

<beans:bean id="passwordencoder" class="org.springframework.security.crypto.bcrypt.bcryptpasswordencoder" />

and pass reference bean authenticationprovider this:

<authentication-manager alias="authenticationmanager">     <authentication-provider>        <!-- actual auth provider here -->        <password-encoder ref="passwordencoder" />     </authentication-provider> </authentication-manager> 

as serge says, bcrypt more secure against brute forcing passwords , added benefit, encoder bean can @autowired classes can programatically encode passwords when creating new user example.

@autowired private bcryptpasswordencoder encoder;  public void createuser(user user){     user.setpassword(encoder.encode("passwordstringhere");     .     .     . }