password_encryption

password_encryption is the PostgreSQL setting that chooses the algorithm for encrypting passwords.

Note

Fact — official short description: “Chooses the algorithm for encrypting passwords.”

Identity

Type , Valueenum: Upstream pg_settings type
Context , Valueuser: Settable by an ordinary user
Unit , Value—: Raw unit
Range , Value—: Raw limits in the last observed version
Enum values , Valuemd5, scram-sha-256: — for non-enum types
Category , ValueConnections and Authentication / Authentication: Upstream classification
Latest boot value , Valuescram-sha-256: scram-sha-256

Lifecycle

Fact	Value
First observed	PG9.0 (research boundary)
Present in	PG9.0–19 Beta 3
Removed in	No
Introduction commit	Not asserted: predates the PG9.0 research boundary
Commit date	—
Discussion	—

Default history

Measured PG9.0–19 Beta 3 boot defaults
Versions	Raw `boot_val`	Unit	Human value
PG9.0–9.6	`on`	—	on
PG10–13	`md5`	—	md5
PG14–19 Beta 3	`scram-sha-256`	—	scram-sha-256

How it works

password_encryption chooses the algorithm for encrypting passwords. It affects secrets generated by CREATE ROLE, ALTER ROLE, and password-setting commands; existing stored secrets are not rehashed automatically.

password_encryption is a USER-context setting. An authorized role can change it for a session, while ALTER ROLE or ALTER DATABASE can establish a default for future sessions.

The final authentication path combines this setting with pg_hba.conf, role attributes, credential material, client capabilities, and sometimes operating-system identity services.

Tuning advice

Tip

Advice. These are workload-specific starting points and must be validated with measurements.

Workload	Guidance
OLTP	Set password_encryption from the authentication architecture and security policy, not workload throughput. Test every driver, identity mapping, failover path, and credential-rotation procedure.
OLAP	Apply the same security baseline to analytical access; isolate any legacy client exception to a dedicated role and a dated migration plan.
Small nodes	Prefer the current secure default for password_encryption. Avoid weakening authentication to save marginal CPU on a small node; reduce connection churn with pooling instead.

Pigsty

Values use the fixed 8-vCPU, 32-GiB, 100-GiB SSD fixture and render the current Pigsty templates for PG19 Beta 3; this does not assert current Pigsty support for that historical or beta release.

Template	Effective value	Versus upstream boot	Source expression
OLTP	`scram-sha-256`	same as boot	`{{ pg_pwd_enc\|default('scram-sha-256') }}`
OLAP	`scram-sha-256`	same as boot	`{{ pg_pwd_enc\|default('scram-sha-256') }}`
CRIT	`scram-sha-256`	same as boot	`{{ pg_pwd_enc\|default('scram-sha-256') }}`
TINY	`scram-sha-256`	same as boot	`{{ pg_pwd_enc\|default('scram-sha-256') }}`

Caution

Advice — pending human review. Fact from the current Pigsty template projection: OLTP: PG9.0–19 Beta 3 = scram-sha-256 (dcs); OLAP: PG9.0–19 Beta 3 = scram-sha-256 (dcs); CRIT: PG9.0–19 Beta 3 = scram-sha-256 (dcs); TINY: PG9.0–19 Beta 3 = scram-sha-256 (dcs). Advice, pending human review — Editorial inference: SCRAM-SHA-256 establishes a modern password-secret baseline consistently across profiles and supported PostgreSQL releases.

Common pitfalls

Changing password_encryption in one session and assuming role defaults, database defaults, or other pooled sessions changed with it.
Changing one authentication setting without testing pg_hba.conf ordering, existing secrets, mappings, and every client library.
Weakening identity policy to solve connection churn or CPU cost that should be addressed with pooling and capacity planning.
Changing the algorithm and assuming existing role secrets are automatically converted.

scram_iterations · md5_password_warnings · authentication_timeout · oauth_validator_libraries · krb_server_keyfile