{"id":110550,"date":"2026-05-15T12:00:00","date_gmt":"2026-05-15T12:00:00","guid":{"rendered":"https:\/\/www.red-gate.com\/simple-talk\/?p=110550"},"modified":"2026-05-13T20:10:10","modified_gmt":"2026-05-13T20:10:10","slug":"postgresql-is-removing-md5-authentication-for-passwords-heres-everything-you-need-to-know","status":"publish","type":"post","link":"https:\/\/www.red-gate.com\/simple-talk\/databases\/postgresql\/postgresql-is-removing-md5-authentication-for-passwords-heres-everything-you-need-to-know\/","title":{"rendered":"PostgreSQL is removing MD5 authentication for passwords. Here’s what it means for your databases"},"content":{"rendered":"\n

Upcoming versions of PostgreSQL will be phasing out the MD5 hashing method within the authentication infrastructure of the database, as first suggested by Nathan Bossart<\/a> in 2024. In doing so, PostgreSQL will become a safer and more secure database for everyone. Its architecture will be more resilient to brute-force attacks, more computationally expensive to deal with, and more suitable for secure authentication.<\/strong><\/p>\n\n\n\n

In this article, Lukas Vileikis details everything you need to know – including what this all means for<\/strong> your application, your database, and your users.<\/strong><\/p>\n\n\n\n

In late 2024, a message by Nathan Bossart hit the database spotlight<\/a>. Within it, he proposed a \u201cmulti-year, incremental approach to remove MD5<\/a> password support from PostgreSQL<\/a>.\u201d<\/em><\/p>\n\n\n\n

Before we dive in completely, let’s establish one important thing first: what exactly is MD5?<\/p>\n\n\n\n

What is MD5 authentication for passwords?<\/h2>\n\n\n\n

Put simply: it\u2019s a hashing mechanism that was used widely to hash passwords in the past. Hashing is the process of transforming data into a hash value, or, in other words, a string of characters, using a hash function (sort of a formula in math.) <\/strong><\/p>\n\n\n\n

Hashes are a one-way function, meaning that it\u2019s impossible to \u201creverse\u201d a hash function (and to know what the hashed value was.) As such, hashing is used for digital fingerprinting and integrity validation – and there’s also password hashing.<\/p>\n\n\n\n

There are multiple functions incorporating password hashing, all of which are outside the scope of this blog. However, to summarize, these are functions like Blowfish and BCrypt<\/a>, and others like PBKDF2 – which we’ll explore a bit more later.<\/p>\n\n\n\n

MD5 used<\/em> to be a popular choice, but technology evolved and MD5 didn’t. So, it\u2019s now considered outdated and insecure.<\/p>\n\n\n\n

What about PostgreSQL’s support for MD5 authentication?<\/h2>\n\n\n\n

A decade or so ago, when computing power was far smaller than it is now, MD5 was considered an ‘okay’ hashing mechanism. As such, many databases – NoSQL<\/a> and SQL-based platforms alike – quickly implemented MD5 into their architecture. It was simple to implement, came with little overhead, and found other suitable use cases as well.<\/strong><\/p>\n\n\n\n

However, as time went on, even news sources like The Register started picking up on issues with MD5 relating to databases like PostgreSQL<\/a>. <\/p>\n\n\n\n

MD5 was farewelled from PostgreSQL\u2019s authentication mechanism back in 2017, switching to a version of SHA-256<\/a> instead. PostgreSQL took this approach because doing so fixed several weaknesses in how passwords were stored. <\/p>\n\n\n\n

With this version of SHA-256, passwords were ‘salted’<\/a> (a random value would be appended to hashed values making massive values of hashes harder to crack for an attacker). Hashing would be intentionally slower. And, finally, computations on such a hashing algorithm would be far more expensive than on default MD5.<\/p>\n\n\n\n

\n
\n
\n
\n

Protect your data. Demonstrate compliance.<\/h3>\n
\n With Redgate, stay ahead of threats with real-time monitoring and alerts, protect sensitive data with automated discovery & masking, and demonstrate compliance with traceability across every environment. <\/div>\n <\/div>\n Learn more<\/a>\n <\/div>\n <\/div>\n<\/section>\n\n\n

PostgreSQL removing MD5: how it came to be<\/h2>\n\n\n\n

First, it’s important to note that PostgreSQL’s developers have only started taking the steps<\/em> to effectively suspend support for MD5 hashing going forward. So, for now, MD5 is still supported – but with caveats:<\/strong><\/p>\n\n\n

\n