Default PostgreSQL password encryption method

Question

I want to know what is the default encryption method used (if any) by PostgreSQL if I do not specify ENCRYPTED while Creating a user or Altering a Role.

I read the following on the PostgreSQL website:

Password Storage Encryption By default, database user passwords are stored as MD5 hashes, so the administrator cannot determine the actual password assigned to the user. If MD5 encryption is used for client authentication, the unencrypted password is never even temporarily present on the server because the client MD5-encrypts it before being sent across the network.

But I am not sure if MD5 encryption method is used only when I use ENCRYPTED while creating/altering role/user.

I am using PostgreSQL 9.5

Thanks

Evan Carroll · Accepted Answer · 2017-04-10 19:40:21Z

5

From the docs

These key words control whether the password is stored encrypted in the system catalogs. (If neither is specified, the default behavior is determined by the configuration parameter password_encryption.) If the presented password string is already in MD5-encrypted format, then it is stored encrypted as-is, regardless of whether ENCRYPTED or UNENCRYPTED is specified (since the system cannot decrypt the specified encrypted password string). This allows reloading of encrypted passwords during dump/restore.

password_encryption defaults to true., though you can check it with SHOW password_encryption.

According to the encryption options,

Password Storage Encryption By default, database user passwords are stored as MD5 hashes, so the administrator cannot determine the actual password assigned to the user. If MD5 encryption is used for client authentication, the unencrypted password is never even temporarily present on the server because the client MD5-encrypts it before being sent across the network.

answered Apr 10, 2017 at 19:40

Evan Carroll

1

Sign up to request clarification or add additional context in comments.

3 Comments

P_Ar Over a year ago

Thanks for the info Evan. I ran the query: Show password_encryption and it says YES. Does that mean the pg_user passwords are saved with MD5 encryption?

P_Ar Over a year ago

Is there a way to store the user passwords as SHA instead of MD5?

Evan Carroll Over a year ago

@P_Ar different question.

Collectives™ on Stack Overflow

Default PostgreSQL password encryption method

1 Answer 1

3 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

3 Comments

Your Answer

Sign up or log in

Post as a guest

Related