@Override
    public Password decode(String encodedPassword) throws GeneralSecurityException {
        Map<String, String> params = Csv.parseCsvMap(encodedPassword);
        String keyFactoryAlg = params.get(PasswordEncoder.KEY_FACTORY_ALGORITHM);
        String cipherAlg = params.get(PasswordEncoder.CIPHER_ALGORITHM);
        int keyLength = Integer.parseInt(params.get(PasswordEncoder.KEY_LENGTH));
        byte[] salt = PasswordEncoder.base64Decode(params.get(PasswordEncoder.SALT));
        int iterations = Integer.parseInt(params.get(PasswordEncoder.ITERATIONS));
        byte[] encryptedPassword = PasswordEncoder.base64Decode(params.get(PasswordEncoder.ENCRYPTED_PASSWORD));
        int passwordLengthProp = Integer.parseInt(params.get(PasswordEncoder.PASSWORD_LENGTH));
        Cipher cipher = Cipher.getInstance(cipherAlg);
        SecretKeyFactory keyFactory = secretKeyFactory(keyFactoryAlg);
        SecretKeySpec keySpec = secretKeySpec(keyFactory, cipherAlg, keyLength, salt, iterations);
        cipher.init(Cipher.DECRYPT_MODE, keySpec, cipherParamsEncoder.toParameterSpec(params));
        try {
            byte[] decrypted = cipher.doFinal(encryptedPassword);
            String password = new String(decrypted, StandardCharsets.UTF_8);
            if (password.length() != passwordLengthProp) // Sanity check
                throw new ConfigException("Password could not be decoded, sanity check of length failed");
            return new Password(password);
        } catch (Exception e) {
            throw new ConfigException("Password could not be decoded", e);
        }
    }
@param secret The secret used for encoding and decoding
@param keyFactoryAlgorithm  Key factory algorithm if configured. By default, PBKDF2WithHmacSHA512 is
                            used if available, PBKDF2WithHmacSHA1 otherwise.
@param cipherAlgorithm Cipher algorithm used for encoding.
@param keyLength Key length used for encoding. This should be valid for the specified algorithms.
@param iterations Iteration count used for encoding.
The provided `keyFactoryAlgorithm`, `cipherAlgorithm`, `keyLength` and `iterations` are used for encoding passwords.
The values used for encoding are stored along with the encoded password and the stored values are used for decoding.
server-common/src/main/java/org/apache/kafka/security/EncryptingPasswordEncoder.java