PostgreSQL stores user passwords in the pg_authid system catalog using a method-specific hash. The traditional MD5 method computes MD5(password + username) and prepends the literal string "md5" to produce a 35-character string. This is the format expected when manually updating a user's password hash in the database.
The stored password is: "md5" + MD5(password + username). For example, if the username is "alice" and the password is "secret", the hash is: "md5" + MD5("secretalice"). The username is concatenated directly (no separator) and acts as a static salt.
ALTER USER alice PASSWORD 'md5abc123...';
Or to use a plain password and let PostgreSQL hash it: ALTER USER alice PASSWORD 'mypassword';
password_encryption = scram-sha-256 in postgresql.confThe username acts as a static salt in PostgreSQL's MD5 scheme. Two users with the same password will have different hashes because their usernames differ. However, static salts are weaker than the random salts used by bcrypt or SCRAM.
Set password_encryption = scram-sha-256 in postgresql.conf, then have each user reset their password. The hash will be re-generated using SCRAM automatically.