md5_password_warnings

md5_password_warnings is the PostgreSQL setting that controls whether PostgreSQL enables deprecation warnings for MD5 passwords.

Note

Fact — official short description: “Enables deprecation warnings for MD5 passwords.”

Identity

Type , Valuebool: Upstream pg_settings type
Context , Valueuser: Settable by an ordinary user
Unit , Value—: Raw unit
Range , Value—: Raw limits in the last observed version
Enum values , Value—: — for non-enum types
Category , ValueConnections and Authentication / Authentication: Upstream classification
Latest boot value , Valueon: on

Lifecycle

Fact	Value
First observed	PG18
Present in	PG18–19 Beta 3
Removed in	No
Introduction commit	`db6a4a985bc0` — Deprecate MD5 passwords.
Commit date	2024-12-02
Discussion	thread 1

Default history

Measured PG9.0–19 Beta 3 boot defaults
Versions	Raw `boot_val`	Unit	Human value
PG18–19 Beta 3	`on`	—	on

How it works

md5_password_warnings controls a PostgreSQL 18 deprecation WARNING emitted when CREATE ROLE or ALTER ROLE sets an MD5-encrypted password. It does not report authentication with an existing MD5 verifier and is therefore not an inventory of active MD5 clients or roles.

It is a USER-context setting, so an authorized role can change it for the current session and ALTER ROLE or ALTER DATABASE can establish future-session defaults. The warning can only arise in a session that both performs a password-setting statement and has the setting enabled.

password_encryption controls the format generated when plaintext passwords are set, while existing pg_authid verifiers remain unchanged until their passwords are reset. Migration therefore needs a protected verifier inventory, client compatibility testing, and credential rotation in addition to this warning.

Tuning advice

Tip

Advice. These are workload-specific starting points and must be validated with measurements.

Workload	Guidance
OLTP	Keep md5_password_warnings on, but treat each warning only as evidence that a password-setting statement created or supplied an MD5 verifier. Separately inventory existing verifier types and test every authentication path before enforcing SCRAM-only access.
OLAP	Use the same rule for analytical roles: a silent legacy driver may continue authenticating with an old MD5 verifier without generating this warning, so test and rotate those credentials explicitly.
Small nodes	Leave the warning enabled; its cost is negligible. Do not mistake an empty warning stream for proof that no MD5 verifiers or MD5-only clients remain.

Pigsty

Values use the fixed 8-vCPU, 32-GiB, 100-GiB SSD fixture and render the current Pigsty templates for PG19 Beta 3; this does not assert current Pigsty support for that historical or beta release.

Template	Effective value	Versus upstream boot	Source expression
OLTP	Unmodified	—	—
OLAP	Unmodified	—	—
CRIT	Unmodified	—	—
TINY	Unmodified	—	—

Caution

Advice — pending human review. Fact from the current Pigsty template projection: OLTP: PG18–19 Beta 3 unmodified; OLAP: PG18–19 Beta 3 unmodified; CRIT: PG18–19 Beta 3 unmodified; TINY: PG18–19 Beta 3 unmodified. No Pigsty-specific rationale is inferred from an absent override.

Common pitfalls

Assuming the warning fires when an existing MD5 verifier is used for authentication; it fires only when CREATE ROLE or ALTER ROLE sets one.
Using the absence of warnings as proof that the cluster has no MD5 secrets or MD5-only clients.
Disabling the warning in deployment sessions that create or rotate roles and thereby hiding new MD5 verifier creation.
Changing password_encryption without rotating existing role passwords, which leaves their stored verifier format unchanged.

password_encryption · scram_iterations · authentication_timeout · oauth_validator_libraries · krb_server_keyfile