Log in to the database with SCRAM instead of MD5

How to do it

In PostgreSQL, set password_encryption = scram-sha-256 and then set each password again, so the stored hash changes. Use scram-sha-256 in every pg_hba.conf line, never md5, password or trust. PostgreSQL 18 deprecates MD5 passwords and plans to remove them in a future major release. Clients can insist on SCRAM with require_auth=scram-sha-256 in the connection string. Set a pooler such as PgBouncer to SCRAM too, as in Pool database connections. Encrypt the connection as well, as Force encryption on every managed service says. Give that login only the rights in Give the app a least-privilege database user.

Examples

SQL example

ALTER SYSTEM SET password_encryption = 'scram-sha-256';
SELECT pg_reload_conf();
ALTER ROLE shop_app PASSWORD 'new-password-from-the-secrets-store';
SELECT rolname FROM pg_authid WHERE rolpassword LIKE 'md5%';   -- must return no rows

Plain text example

# pg_hba.conf
hostssl  shop  shop_app  10.0.0.0/24  scram-sha-256

Shell example

psql "host=db.example.com dbname=shop user=shop_app sslmode=verify-full require_auth=scram-sha-256" -c 'select 1'
grep -nE '\s(md5|password|trust)\s*$' /etc/postgresql/*/main/pg_hba.conf   # must print nothing

How to check

The query on stored hashes returns no role with an MD5 password. No line in pg_hba.conf uses md5, password or trust for a network address. A connection with require_auth=scram-sha-256 succeeds for each app user.

Sources

• PostgreSQL 18 release notes
• PostgreSQL documentation on password authentication
• libpq connection parameters

Related rules

• Pool database connections in Data
• Force encryption on every managed service in Infrastructure
• Give the app a least-privilege database user in Data
• Use PgBouncer when many app servers share PostgreSQL in Software choices