Websphere Liberty Password Encoding with AES need to add tags like {aes256} to differentiate passwords from {aes} which is aes128

Websphere Liberty Password Encoding with AES need to add tags like {aes256} to differentiate passwords from {aes} which is aes128

All the users who are using websphere liberty will benficial as its easiest way to differentiate the aes passwords from configurations else difficult to visually tell if its encodeded with aes128 or aes256.

Currently there is no other way to tell if the password is encoded with aes256 or aes128 by like this {aes} tag

https://openliberty.io/blog/2024/12/17/25.0.0.1-beta.html

-----------------------------------------------------

23rd Jan 2026 Updates

Here to Explain more as per the request

When using securityutility command for encoding password , After 25.0.0.2 version when selected for aes encoding of password it will be encoded with aes256 by default . but the password tag is always with {aes}. There is no differentiator is main issue.

Passwords which are created prior to 25.0.0.2 also when aes encoding mode is selctd even here also password will be encoded but with aes128 as we know.

crazy thing is passsword tag for aes128 is also {aes}

So the encoded passwords in server.xml of jvms prior to 25.0.0.2 version will be having aes128 passwords even though liberty binaries are upgraded to latest 25.0.0.2 and above.

here though after liberty 25.0.0.2 version aes256 is supported but the passwords which are already encoded with aes128 in the server.xml will be present.

after 25.0.0.2

aes128 is also being supported along with aes256 and there is no failure or startup failures being available in the JVM for using aes128 passwords.

though in the JVM logs mentions as aes128 passwords are used, but its difficult to identify which passwords are aes128 and aes256 as both passwords having tag with {aes} when there are 100’s pf passwords which are encoded with aes and present with {aes}

there is no differentiation.

Either provide an differentiation for aes256 as {aes256} when passwords encoded from 25.0.0.2 version onwards

or

provide an jvm startup failure when using aes128 passwords from 25.0.0.2 version

This will help in Maintaining the System of passwords properly as passwords once encoded its difficult to tell visibly if its aes128 or aes256 encoded .

Let us know if any more details