pg_pwhash

Advanced password hashing methods for PostgreSQL

Overview

PackageVersionCategoryLicenseLanguage
pg_pwhash1.0SECMITC
IDExtensionBinLibLoadCreateTrustRelocSchema
7330pg_pwhashNoYesNoYesNoYes-

RPM metadata shows license=PostgreSQL, but packaged LICENSE file is MIT

Version

TypeRepoVersionPG VerPackageDeps
EXTPGDG1.01817161514pg_pwhash-
RPMPGDG1.01817161514pg_pwhash_$v-
DEBPGDG1.01817161514postgresql-$v-pg-pwhash-
OS / PGPG18PG17PG16PG15PG14
el8.x86_64
el8.aarch64
el9.x86_64
el9.aarch64
el10.x86_64
el10.aarch64
d12.x86_64
PGDG 1.0
PGDG 1.0
PGDG 1.0
PGDG 1.0
PGDG 1.0
d12.aarch64
PGDG 1.0
PGDG 1.0
PGDG 1.0
PGDG 1.0
PGDG 1.0
d13.x86_64
PGDG 1.0
PGDG 1.0
PGDG 1.0
PGDG 1.0
PGDG 1.0
d13.aarch64
PGDG 1.0
PGDG 1.0
PGDG 1.0
PGDG 1.0
PGDG 1.0
u22.x86_64
PGDG 1.0
PGDG 1.0
PGDG 1.0
PGDG 1.0
PGDG 1.0
u22.aarch64
PGDG 1.0
PGDG 1.0
PGDG 1.0
PGDG 1.0
PGDG 1.0
u24.x86_64
PGDG 1.0
PGDG 1.0
PGDG 1.0
PGDG 1.0
PGDG 1.0
u24.aarch64
PGDG 1.0
PGDG 1.0
PGDG 1.0
PGDG 1.0
PGDG 1.0

Install

You can install pg_pwhash directly. First, make sure the PGDG repository is added and enabled:

pig repo add pgdg -u          # Add PGDG repo and update cache

Install the extension using pig or apt/yum/dnf:

pig install pg_pwhash;          # Install for current active PG version
pig ext install -y pg_pwhash -v 18  # PG 18
pig ext install -y pg_pwhash -v 17  # PG 17
pig ext install -y pg_pwhash -v 16  # PG 16
pig ext install -y pg_pwhash -v 15  # PG 15
pig ext install -y pg_pwhash -v 14  # PG 14
dnf install -y pg_pwhash_18       # PG 18
dnf install -y pg_pwhash_17       # PG 17
dnf install -y pg_pwhash_16       # PG 16
dnf install -y pg_pwhash_15       # PG 15
dnf install -y pg_pwhash_14       # PG 14
apt install -y postgresql-18-pg-pwhash   # PG 18
apt install -y postgresql-17-pg-pwhash   # PG 17
apt install -y postgresql-16-pg-pwhash   # PG 16
apt install -y postgresql-15-pg-pwhash   # PG 15
apt install -y postgresql-14-pg-pwhash   # PG 14

Create Extension:

CREATE EXTENSION pg_pwhash;

Usage

pg_pwhash: Advanced password hashing for PostgreSQL

pg_pwhash provides modern adaptive password hashing algorithms including Argon2, scrypt, and yescrypt for PostgreSQL.

CREATE EXTENSION pg_pwhash;

Supported Algorithms

IdentifierAlgorithmSalt Pattern
argon2iArgon2i$argon2i$v=19$m=4096,t=3,p=1$<salt>
argon2dArgon2d$argon2d$v=19$m=4096,t=3,p=1$<salt>
argon2idArgon2id$argon2id$v=19$m=4096,t=3,p=1$<salt>
scryptScrypt$scrypt$ln=16,r=8,p=1$<salt>
$7$Scrypt (crypt)$7$BU<salt>
yescryptyescrypt (crypt)$y$j9T$<salt>

Core Functions

Generate Salt and Hash

-- Argon2id (recommended)
SELECT pwhash_crypt('password', pwhash_gen_salt('argon2id'));
-- $argon2id$v=19$m=4096,t=3,p=1$<salt>$<hash>

-- Scrypt
SELECT pwhash_crypt('password', pwhash_gen_salt('scrypt'));

-- Yescrypt
SELECT pwhash_crypt('password', pwhash_gen_salt('yescrypt'));

Verify Password

-- Hash matches if output equals stored hash
SELECT stored_hash = pwhash_crypt('entered_password', stored_hash) AS valid;

Direct Hashing Functions

SELECT pwhash_argon2('password', pwhash_gen_salt('argon2id'));
SELECT pwhash_scrypt('password', pwhash_gen_salt('scrypt'));
SELECT pwhash_yescrypt_crypt('password', pwhash_gen_salt('yescrypt'));

Custom Salt Parameters

-- Argon2 with custom memory/time/parallelism
SELECT pwhash_gen_salt('argon2id', 'm=65536', 't=4', 'p=2');

-- Scrypt with custom parameters
SELECT pwhash_gen_salt('scrypt', 'ln=20', 'r=8', 'p=1');

Configuration

ParameterDescription
pg_pwhash.argon2_default_backendBackend for Argon2: libargon2 or openssl

Last Modified 2026-03-12: add pg extension catalog (95749bf)