---
title: "Log in to the database with SCRAM instead · Agent Wranglers"
url: https://agentwranglers.se/playbook/data/operations/database-scram-auth
updated: 2026-10-21
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Log in to the database with SCRAM instead of MD5

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Operations](https://agentwranglers.se/playbook/data/operations.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers). Updated 2026-10-21.

- ID: DAT-66
- Level: Recommended
- Chapter: [Operations](https://agentwranglers.se/playbook/data/operations)
- Rule: Database logins that use a password use a challenge method such as SCRAM-SHA-256. The server refuses MD5 and plain-text password logins.
- How: In PostgreSQL, set `password_encryption = scram-sha-256` and then set each password again, so the stored hash changes. Use `scram-sha-256` in every `pg_hba.conf` line, never `md5`, `password` or `trust`. PostgreSQL 18 deprecates MD5 passwords and plans to remove them in a future major release. Clients can insist on SCRAM with `require_auth=scram-sha-256` in the connection string. Set a pooler such as PgBouncer to SCRAM too, as in [Pool database connections](https://agentwranglers.se/playbook/data/operations/connection-pooling). Encrypt the connection as well, as [Force encryption on every managed service](https://agentwranglers.se/playbook/infrastructure/networking-and-dns/enforce-tls-on-services) says. Give that login only the rights in [Give the app a least-privilege database user](https://agentwranglers.se/playbook/data/operations/app-database-role).
- Check: The query on stored hashes returns no role with an MD5 password. No line in `pg_hba.conf` uses `md5`, `password` or `trust` for a network address. A connection with `require_auth=scram-sha-256` succeeds for each app user.

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### SQL example

```sql
ALTER SYSTEM SET password_encryption = 'scram-sha-256';
SELECT pg_reload_conf();
ALTER ROLE shop_app PASSWORD 'new-password-from-the-secrets-store';
SELECT rolname FROM pg_authid WHERE rolpassword LIKE 'md5%';   -- must return no rows
```

### Plain text example

```text
# pg_hba.conf
hostssl  shop  shop_app  10.0.0.0/24  scram-sha-256
```

### Shell example

```sh
psql "host=db.example.com dbname=shop user=shop_app sslmode=verify-full require_auth=scram-sha-256" -c 'select 1'
grep -nE '\s(md5|password|trust)\s*$' /etc/postgresql/*/main/pg_hba.conf   # must print nothing
```

## Sources

- [PostgreSQL 18 release notes](https://www.postgresql.org/docs/release/18.0/)
- [PostgreSQL documentation on password authentication](https://www.postgresql.org/docs/current/auth-password.html)
- [libpq connection parameters](https://www.postgresql.org/docs/current/libpq-connect.html)

## Related rules

- [Pool database connections](https://agentwranglers.se/playbook/data/operations/connection-pooling) in Data
- [Force encryption on every managed service](https://agentwranglers.se/playbook/infrastructure/networking-and-dns/enforce-tls-on-services) in Infrastructure
- [Give the app a least-privilege database user](https://agentwranglers.se/playbook/data/operations/app-database-role) in Data
- [Use PgBouncer when many app servers share PostgreSQL](https://agentwranglers.se/playbook/stack/databases-and-storage/pgbouncer) in Software choices

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/data/operations/database-scram-auth">Agent Wranglers data playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Turn off database features that reach the server](https://agentwranglers.se/playbook/data/operations/server-file-access)
- [Operations](https://agentwranglers.se/playbook/data/operations)