# md5_password_warnings

> md5_password_warnings is the PostgreSQL setting that controls whether PostgreSQL enables deprecation warnings for MD5 passwords.
---

> [!NOTE]
> **Fact — official short description:** “Enables deprecation warnings for MD5 passwords.”

## Identity {#identity}

| Field | Value | Meaning |
| --- | --- | --- |
| Type | `bool` | Upstream pg_settings type |
| Context | `user` | Settable by an ordinary user |
| Unit | — | Raw unit |
| Range | — | Raw limits in the last observed version |
| Enum values | — | — for non-enum types |
| Category | Connections and Authentication / Authentication | Upstream classification |
| Latest boot value | `on` | on |
{.fields meta="-"}

## Lifecycle {#lifecycle}

| Fact | Value |
| --- | --- |
| First observed | PG18 |
| Present in | PG18–19 Beta 3 |
| Removed in | No |
| Introduction commit | [`db6a4a985bc0`](https://git.postgresql.org/gitweb/?p=postgresql.git;a=commit;h=db6a4a985bc09d260d5c29848e3c97f080646a53) — Deprecate MD5 passwords. |
| Commit date | 2024-12-02 |
| Discussion | [thread 1](https://postgr.es/m/ZwbfpJJol7lDWajL%40nathan) |

## Default history {#default-history}

| Versions | Raw `boot_val` | Unit | Human value |
| --- | --- | --- | --- |
| PG18–19 Beta 3 | `on` | — | on |
{.full-width caption="Measured PG9.0–19 Beta 3 boot defaults"}

## How it works {#mechanism}

md5_password_warnings controls a PostgreSQL 18 deprecation WARNING emitted when CREATE ROLE or ALTER ROLE sets an MD5-encrypted password. It does not report authentication with an existing MD5 verifier and is therefore not an inventory of active MD5 clients or roles.

It is a USER-context setting, so an authorized role can change it for the current session and ALTER ROLE or ALTER DATABASE can establish future-session defaults. The warning can only arise in a session that both performs a password-setting statement and has the setting enabled.

password_encryption controls the format generated when plaintext passwords are set, while existing pg_authid verifiers remain unchanged until their passwords are reset. Migration therefore needs a protected verifier inventory, client compatibility testing, and credential rotation in addition to this warning.

## Tuning advice {#tuning-advice}

> [!TIP]
> **Advice.** These are workload-specific starting points and must be validated with measurements.

| Workload | Guidance |
| --- | --- |
| OLTP | Keep md5_password_warnings on, but treat each warning only as evidence that a password-setting statement created or supplied an MD5 verifier. Separately inventory existing verifier types and test every authentication path before enforcing SCRAM-only access. |
| OLAP | Use the same rule for analytical roles: a silent legacy driver may continue authenticating with an old MD5 verifier without generating this warning, so test and rotate those credentials explicitly. |
| Small nodes | Leave the warning enabled; its cost is negligible. Do not mistake an empty warning stream for proof that no MD5 verifiers or MD5-only clients remain. |
{.full-width}

## Pigsty {#pigsty}

Values use the fixed 8-vCPU, 32-GiB, 100-GiB SSD fixture and render the current Pigsty templates for PG19 Beta 3; this does not assert current Pigsty support for that historical or beta release.

| Template | Effective value | Versus upstream boot | Source expression |
| --- | --- | --- | --- |
| OLTP | Unmodified | — | — |
| OLAP | Unmodified | — | — |
| CRIT | Unmodified | — | — |
| TINY | Unmodified | — | — |
{.full-width}

> [!CAUTION]
> **Advice — pending human review.** Fact from the current Pigsty template projection: OLTP: PG18–19 Beta 3 unmodified; OLAP: PG18–19 Beta 3 unmodified; CRIT: PG18–19 Beta 3 unmodified; TINY: PG18–19 Beta 3 unmodified. No Pigsty-specific rationale is inferred from an absent override.

## Common pitfalls {#common-pitfalls}

- Assuming the warning fires when an existing MD5 verifier is used for authentication; it fires only when CREATE ROLE or ALTER ROLE sets one.
- Using the absence of warnings as proof that the cluster has no MD5 secrets or MD5-only clients.
- Disabling the warning in deployment sessions that create or rotate roles and thereby hiding new MD5 verifier creation.
- Changing password_encryption without rotating existing role passwords, which leaves their stored verifier format unchanged.

## Related parameters {#related-parameters}

[`password_encryption`](/parameters/password-encryption/) · [`scram_iterations`](/parameters/scram-iterations/) · [`authentication_timeout`](/parameters/authentication-timeout/) · [`oauth_validator_libraries`](/parameters/oauth-validator-libraries/) · [`krb_server_keyfile`](/parameters/krb-server-keyfile/)

## References {#references}

- [PostgreSQL 19 Beta 3 — md5_password_warnings](https://www.postgresql.org/docs/19/runtime-config-connection.html#GUC-MD5-PASSWORD-WARNINGS)
- [PostgreSQL 19 release notes](https://www.postgresql.org/docs/19/release-19.html)
- [Machine-readable GUC export](/data/guc.jsonl)