To move PostgreSQL from md5 to scram-sha-256, confirm every client library supports SCRAM, set password_encryption to scram-sha-256, have each role set a new password, then change pg_hba.conf to scram-sha-256. Existing md5 hashes are not converted automatically, so the password reset step cannot be skipped.
Why bother
The PostgreSQL manual says MD5 password support is deprecated and will be removed in a future release. It also says the MD5 hash algorithm is no longer considered secure against determined attacks, and that md5 authentication gives no protection if an attacker steals the password hash from the server. SCRAM-SHA-256 is described as the most secure of the currently provided methods.
Step 1: check your clients
SCRAM is not supported by older client libraries. Inventory every driver and tool that connects: application services, migration runners, BI tools, backup jobs and anything on a laptop. Upgrade or replace the ones that cannot do SCRAM. This is where migrations stall, so do it first.
Step 2: set password_encryption
In postgresql.conf, set:
password_encryption = 'scram-sha-256'
The stored hash type depends on this setting at the moment a password is set. Changing it affects only passwords set from now on.
Step 3: reset passwords
Every role needs a new password so a SCRAM hash gets stored. Use ALTER ROLE or \password in psql. You can inspect what is stored by querying the pg_authid catalog, to see the stored hash for each role. Plan the reset with the owner of each application, because the app needs the new secret at the same moment.
Step 4: update pg_hba.conf
Change the method fields from md5 to scram-sha-256. One useful property from the manual: if md5 is listed but the role's password is already SCRAM encrypted, SCRAM is chosen automatically. That lets you migrate role by role while md5 is still in the file, then tighten the file at the end.
The manual's own example keeps md5 only for a single user on an older client and uses scram-sha-256 for everyone else. Treat that as a short term exception with a removal date. For rule order, see how pg_hba.conf matching works.
Watch for plain password methods
The password method sends the password in clear text. A SCRAM password can be used with it, but you should not choose it over an untrusted network. Plain-text storage of passwords is no longer possible in current PostgreSQL.
Quick check
Does changing password_encryption convert my existing md5 passwords?
No. Each role must set a new password after the change so a SCRAM hash is stored.
Can I migrate one role at a time?
Yes. A role with a SCRAM password authenticates under an md5 line in pg_hba.conf, so you can move roles gradually and switch the file last.
Sources
Last reviewed: 19 October 2026.
