@Override
    public byte[] encode(byte[] rawPassword) {
        int length = rawPassword.length;
        if (length > BCrypt.MAX_PASSWORD_BYTES) {
            throw new IllegalArgumentException(
                    "The password length must be less than "
                            + BCrypt.MAX_PASSWORD_BYTES);
        }
        if (length != BCrypt.MAX_PASSWORD_BYTES) {
            rawPassword = ArrayUtil.concat(rawPassword, NULL_TERMINATOR);
        }
        byte[] salt = new byte[SALT_SIZE_BYTES];
        ThreadLocalRandom.current()
                .nextBytes(salt);
        byte[] encodedPassword = BCRYPT.get()
                .deriveRawKey(COST, salt, rawPassword);

        int encodedPasswordLength = encodedPassword.length;
        int resultLength = VERSION_BYTES + SALT_SIZE_BYTES + encodedPasswordLength;
        byte[] result = new byte[resultLength];
        System.arraycopy(salt, 0, result, 0, SALT_SIZE_BYTES);
        System.arraycopy(encodedPassword, 0, result, SALT_SIZE_BYTES, encodedPasswordLength);
        // The last byte indicates the version and cost.
        result[resultLength - 1] = (byte) COST;
        return result;
    }
@implNote The implementation doesn't validate the null terminator in the raw password to
          avoid double checks, and it is the responsibility of the caller to ensure that no
          null terminator is in the raw password.
turms-server-common/src/main/java/im/turms/server/common/infra/security/password/BCryptPasswordEncoder.java