password_encryption
No restart — settable per sessionenum: scram-sha-256 / md5
The algorithm used to store new role passwords — use SCRAM, not MD5.
What it does
password_encryption sets how PostgreSQL hashes a password when you create or change a role's password. scram-sha-256 (the default since PostgreSQL 14) is a modern, salted, challenge-response scheme; the legacy md5 method is weak and deprecated.
How to tune it
Leave it at scram-sha-256. The one catch: existing md5 passwords aren't upgraded automatically — users must reset their password to get a SCRAM hash, and clients/drivers must support SCRAM (almost all modern ones do). Plan a password-reset cycle when migrating off md5.
FAQ
- How do I migrate from md5 to scram-sha-256?
- Set password_encryption = scram-sha-256, ensure clients support SCRAM, then have each role reset its password (ALTER ROLE … PASSWORD …) so a new SCRAM hash is stored. Existing md5 hashes keep working until reset, then update pg_hba.conf to require scram.