password_encryption (enum)

• Default value: md5

This configuration parameter determines the algorithm used to hash a local database user's password when the password is set with CREATE ROLE or ALTER ROLE (or the equivalent CREATE USER and ALTER USER commands).

Supported values:

md5

Hash the password using MD5. This is the default and matches the behavior of earlier releases.

scram-sha-256

Hash the password using SCRAM-SHA-256 (RFC 7677). SCRAM-SHA-256 uses only FIPS-approved primitives and allows clients in FIPS-enabled environments to authenticate with local database accounts. See Password Encryption.

Setting this parameter affects only passwords that are set or changed afterward; it does not re-encrypt existing passwords. An existing MD5 password cannot be converted to SCRAM-SHA-256, because the original password cannot be recovered from an MD5 hash; the user must set a new password.

For backward compatibility, the legacy boolean values (on, true, off, false) are still accepted and are treated as md5, so existing configurations continue to load unchanged. Note that off no longer stores passwords in plain text; it is equivalent to md5. Any passwords already stored in plain text continue to authenticate until they are reset.

You can modify this parameter with the following commands:

• SET: Applies to subsequent CREATE ROLE and ALTER ROLE statements in the current session only.

• ALTER SYSTEM: Only sysadmin users can change the system-wide default with this command. A configuration reload is required for the new value to take effect. It then applies to all passwords set or changed afterward.

The server chooses the authentication mechanism for each login based on how that user's password is stored, so MD5 and SCRAM-SHA-256 accounts can coexist with no change to host-based authentication.