NoSuchBeanDefinitionException: No qualifying bean of type 'org.springframework.security.crypto.encrypt.TextEncryptor'

Q: Configure the encrypt.key property

When to use: Use this as the primary fix for symmetric encryption.. Setting `encrypt.key` tells Spring Cloud Config to create a default TextEncryptor bean using that symmetric key.

Q: Provide an Asymmetric Keystore

When to use: Use this if you prefer RSA encryption over symmetric keys.. Configure an RSA key pair via a Java Keystore.

Q: Define a custom TextEncryptor Bean

When to use: Use this if you have a custom decryption mechanism.. Manually instantiate the TextEncryptor in a configuration class.

Q: Remove the {cipher} prefix

When to use: Use this if the property isn't actually encrypted.. If you accidentally left the `{cipher}` prefix on a plain-text property, remove it.

Q: Set fail-fast=false on the client

When to use: Use this if the client should start even if the config server fails.. Prevents the client application from crashing if the config server cannot decrypt the properties.

🔴 The Error You're Seeing

Confirm this matches your console output. If it does, you're in the right place.

ERROR LOG

2026-02-20 14:15:22.410 ERROR 8842 --- [           main] o.s.boot.SpringApplication               : Application run failed

org.springframework.beans.factory.NoSuchBeanDefinitionException: No qualifying bean of type 'org.springframework.security.crypto.encrypt.TextEncryptor' available
	at org.springframework.beans.factory.support.DefaultListableBeanFactory.getBean(DefaultListableBeanFactory.java:335)

⚡ Quick Fix Works 80% of the time

Set the encrypt.key property in your Config Server's application.properties.

encrypt.key=my-super-secret-key

🧠 Why this Happens

Tap to expand the deep technical explanation

You marked a property with `{cipher}` in your Spring Cloud Config Server repository. When the client requests the configuration, the server attempts to decrypt it before sending it. However, the server doesn't have a `TextEncryptor` bean because the `encrypt.key` property is missing, causing the application context to fail.

The HITEC City Parking Spot Analogy:

It's like receiving a locked safe (the {cipher} property) but you never bought a key (TextEncryptor) to open it. The delivery person refuses to hand over the safe because you can't unlock it on the spot.

🔁 How to Reproduce Confirm this is your error

Create a Spring Cloud Config Server. Add `user.password={cipher}AQA...` to the config repository. Do NOT set `encrypt.key` in the server's properties. Start the server and request the config.

🛠️ Solutions (5 Ways to Fix)

Solution 1✓ Most common cause

Configure the encrypt.key property

👉 Use this as the primary fix for symmetric encryption.

Setting `encrypt.key` tells Spring Cloud Config to create a default TextEncryptor bean using that symmetric key.

# application.properties (Config Server)
encrypt.key=my-super-secret-key

Solution 2

Provide an Asymmetric Keystore

👉 Use this if you prefer RSA encryption over symmetric keys.

Configure an RSA key pair via a Java Keystore.

encrypt.key-store.location=classpath:server.jks
encrypt.key-store.password=letmein
encrypt.key-store.alias=mytestkey
encrypt.key-store.secret=changeme

Solution 3

Define a custom TextEncryptor Bean

👉 Use this if you have a custom decryption mechanism.

Manually instantiate the TextEncryptor in a configuration class.

@Bean
public TextEncryptor textEncryptor() {
    return new Encryptors.noOpTextEncryptor(); // Or custom implementation
}

Solution 4

Remove the {cipher} prefix

👉 Use this if the property isn't actually encrypted.

If you accidentally left the `{cipher}` prefix on a plain-text property, remove it.

# config-repo/application.properties
# Change this: user.password={cipher}mypassword
# To this: user.password=mypassword

Solution 5

Set fail-fast=false on the client

👉 Use this if the client should start even if the config server fails.

Prevents the client application from crashing if the config server cannot decrypt the properties.

# client application.properties
spring.cloud.config.fail-fast=false

📋 Version Notes

Spring Boot 2.x

Uses spring-cloud-context. Keystore config via bootstrap.yml.

Spring Boot 3.x

Uses spring-cloud-config. Keystore config via application.yml. Bootstrap is deprecated.

🛡️ How to Prevent This Next Time

Always ensure your Config Server's `encrypt.key` is set via a secure environment variable before pushing any `{cipher}` properties to the repository.