# password_encryption

> password_encryption is the PostgreSQL setting that chooses the algorithm for encrypting passwords.
---

> [!NOTE]
> **Fact — official short description:** “Chooses the algorithm for encrypting passwords.”

## Identity {#identity}

| Field | Value | Meaning |
| --- | --- | --- |
| Type | `enum` | Upstream pg_settings type |
| Context | `user` | Settable by an ordinary user |
| Unit | — | Raw unit |
| Range | — | Raw limits in the last observed version |
| Enum values | `md5`, `scram-sha-256` | — for non-enum types |
| Category | Connections and Authentication / Authentication | Upstream classification |
| Latest boot value | `scram-sha-256` | scram-sha-256 |
{.fields meta="-"}

## Lifecycle {#lifecycle}

| Fact | Value |
| --- | --- |
| First observed | PG9.0 (research boundary) |
| Present in | PG9.0–19 Beta 3 |
| Removed in | No |
| Introduction commit | Not asserted: predates the PG9.0 research boundary |
| Commit date | — |
| Discussion | — |

## Default history {#default-history}

| Versions | Raw `boot_val` | Unit | Human value |
| --- | --- | --- | --- |
| PG9.0–9.6 | `on` | — | on |
| PG10–13 | `md5` | — | md5 |
| PG14–19 Beta 3 | `scram-sha-256` | — | scram-sha-256 |
{.full-width caption="Measured PG9.0–19 Beta 3 boot defaults"}

## How it works {#mechanism}

password_encryption chooses the algorithm for encrypting passwords. It affects secrets generated by CREATE ROLE, ALTER ROLE, and password-setting commands; existing stored secrets are not rehashed automatically.

password_encryption is a USER-context setting. An authorized role can change it for a session, while ALTER ROLE or ALTER DATABASE can establish a default for future sessions.

The final authentication path combines this setting with pg_hba.conf, role attributes, credential material, client capabilities, and sometimes operating-system identity services.

## Tuning advice {#tuning-advice}

> [!TIP]
> **Advice.** These are workload-specific starting points and must be validated with measurements.

| Workload | Guidance |
| --- | --- |
| OLTP | Set password_encryption from the authentication architecture and security policy, not workload throughput. Test every driver, identity mapping, failover path, and credential-rotation procedure. |
| OLAP | Apply the same security baseline to analytical access; isolate any legacy client exception to a dedicated role and a dated migration plan. |
| Small nodes | Prefer the current secure default for password_encryption. Avoid weakening authentication to save marginal CPU on a small node; reduce connection churn with pooling instead. |
{.full-width}

## Pigsty {#pigsty}

Values use the fixed 8-vCPU, 32-GiB, 100-GiB SSD fixture and render the current Pigsty templates for PG19 Beta 3; this does not assert current Pigsty support for that historical or beta release.

| Template | Effective value | Versus upstream boot | Source expression |
| --- | --- | --- | --- |
| OLTP | `scram-sha-256` | same as boot | `{{ pg_pwd_enc\|default('scram-sha-256') }}` |
| OLAP | `scram-sha-256` | same as boot | `{{ pg_pwd_enc\|default('scram-sha-256') }}` |
| CRIT | `scram-sha-256` | same as boot | `{{ pg_pwd_enc\|default('scram-sha-256') }}` |
| TINY | `scram-sha-256` | same as boot | `{{ pg_pwd_enc\|default('scram-sha-256') }}` |
{.full-width}

> [!CAUTION]
> **Advice — pending human review.** Fact from the current Pigsty template projection: OLTP: PG9.0–19 Beta 3 = scram-sha-256 (dcs); OLAP: PG9.0–19 Beta 3 = scram-sha-256 (dcs); CRIT: PG9.0–19 Beta 3 = scram-sha-256 (dcs); TINY: PG9.0–19 Beta 3 = scram-sha-256 (dcs). Advice, pending human review — Editorial inference: SCRAM-SHA-256 establishes a modern password-secret baseline consistently across profiles and supported PostgreSQL releases.

## Common pitfalls {#common-pitfalls}

- Changing password_encryption in one session and assuming role defaults, database defaults, or other pooled sessions changed with it.
- Changing one authentication setting without testing pg_hba.conf ordering, existing secrets, mappings, and every client library.
- Weakening identity policy to solve connection churn or CPU cost that should be addressed with pooling and capacity planning.
- Changing the algorithm and assuming existing role secrets are automatically converted.

## Related parameters {#related-parameters}

[`scram_iterations`](/parameters/scram-iterations/) · [`md5_password_warnings`](/parameters/md5-password-warnings/) · [`authentication_timeout`](/parameters/authentication-timeout/) · [`oauth_validator_libraries`](/parameters/oauth-validator-libraries/) · [`krb_server_keyfile`](/parameters/krb-server-keyfile/)

## References {#references}

- [PostgreSQL 19 Beta 3 — password_encryption](https://www.postgresql.org/docs/19/runtime-config-connection.html#GUC-PASSWORD-ENCRYPTION)
- [PostgreSQL 19 release notes](https://www.postgresql.org/docs/19/release-19.html)
- [Machine-readable GUC export](/data/guc.jsonl)