{"Entry":{"collection":"guc","key":"md5_password_warnings","name":"md5_password_warnings","aliases":[],"metadata":{"baseline":false,"boot_human":"Not specified","boot_val":null,"category":"Connections and Authentication / Authentication","category_zh":"","changed_in":[],"changes":[{"documentation_changed":false,"fields":{},"from":"17","status":"added","to":"18"},{"documentation_changed":true,"fields":{},"from":"18","status":"changed","to":"19"}],"content_hash":"69acdc944aa8c08730cb97925669d9c4876f65e64640cb86640589c002e91f83","context":"","default_changed_in":[],"default_history":[{"from":"18","to":"19","value":"on"}],"derived_content_hash":"5bf285a023f133505492126d03659ce1dd82a7bac57cf1463cc195391962bcf8","editorial":{"advice":{"olap":"Use the same rule for analytical roles: a silent legacy driver may continue authenticating with an old MD5 verifier without generating this warning, so test and rotate those credentials explicitly.","oltp":"Keep md5_password_warnings on, but treat each warning only as evidence that a password-setting statement created or supplied an MD5 verifier. Separately inventory existing verifier types and test every authentication path before enforcing SCRAM-only access.","small":"Leave the warning enabled; its cost is negligible. Do not mistake an empty warning stream for proof that no MD5 verifiers or MD5-only clients remain."},"mechanism":["md5_password_warnings controls a PostgreSQL 18 deprecation WARNING emitted when CREATE ROLE or ALTER ROLE sets an MD5-encrypted password. It does not report authentication with an existing MD5 verifier and is therefore not an inventory of active MD5 clients or roles.","It is a USER-context setting, so an authorized role can change it for the current session and ALTER ROLE or ALTER DATABASE can establish future-session defaults. The warning can only arise in a session that both performs a password-setting statement and has the setting enabled.","password_encryption controls the format generated when plaintext passwords are set, while existing pg_authid verifiers remain unchanged until their passwords are reset. Migration therefore needs a protected verifier inventory, client compatibility testing, and credential rotation in addition to this warning."],"pitfalls":["Assuming the warning fires when an existing MD5 verifier is used for authentication; it fires only when CREATE ROLE or ALTER ROLE sets one.","Using the absence of warnings as proof that the cluster has no MD5 secrets or MD5-only clients.","Disabling the warning in deployment sessions that create or rotate roles and thereby hiding new MD5 verifier creation.","Changing password_encryption without rotating existing role passwords, which leaves their stored verifier format unchanged."],"references":[{"title":"PostgreSQL 19 Beta 4: md5_password_warnings","url":"https://www.postgresql.org/docs/19/runtime-config-connection.html#GUC-MD5-PASSWORD-WARNINGS"},{"title":"PostgreSQL 19 release notes","url":"https://www.postgresql.org/docs/19/release-19.html"}],"related":["password_encryption","scram_iterations","authentication_timeout","oauth_validator_libraries","krb_server_keyfile"],"summary":"md5_password_warnings is the PostgreSQL setting that controls whether PostgreSQL enables deprecation warnings for MD5 passwords."},"enumvals":[],"first_version":"18","group":"Connections and Authentication","group_slug":"connection","imported_at":"2026-09-27T17:57:31.76947+08:00","intro_commit":{"authored_at":"2024-12-02T13:30:07-06:00","discussion":["https://postgr.es/m/ZwbfpJJol7lDWajL%40nathan"],"hash":"db6a4a985bc09d260d5c29848e3c97f080646a53","subject":"Deprecate MD5 passwords.","url":"https://git.postgresql.org/gitweb/?p=postgresql.git;a=commit;h=db6a4a985bc09d260d5c29848e3c97f080646a53"},"key":"md5_password_warnings","last_version":"20","max_val":"","min_val":"","name":"md5_password_warnings","position":291,"present_in":["18","19","20"],"repair_provenance":{"original_source_revision":"english-manuals:29883d364e63f0a9b902cb950954179de09ad7cab268a60eca3da0457ac9b896","receipt_sha256":"7af2f402efb9d5283defecf75b7ad585011d101481a2eda2cbc16f96f1215bb0","repair":"wiki-repair-20261023"},"short_desc":"Controls whether a WARNING about MD5 password deprecation is produced when a CREATE ROLE or ALTER ROLE statement sets an MD5-encrypted password.","short_desc_zh":"","source_rev":"wiki-repair-20261023:900fc5437fee147c7f400101e423310d34326eaf357754cdf9411c4d0b83b67e","unit":"","vartype":"bool"}},"Definition":{"Collection":"guc","Key":"md5_password_warnings","SourceDatabase":"center","Version":"18","SourceTable":"guc","SourceKey":"md5_password_warnings","SourceRevision":"wiki-repair-20261023:900fc5437fee147c7f400101e423310d34326eaf357754cdf9411c4d0b83b67e","Facts":{"boot_val":"on","category":"Connections and Authentication / Authentication","context":"user","description":"Controls whether a WARNING about MD5 password deprecation is produced when a CREATE ROLE or ALTER ROLE statement sets an MD5-encrypted password. The default value is on.","description_zh":"控制在 CREATE ROLE 或 ALTER ROLE 语句设置 MD5 加密密码时，是否生成有关 MD5 密码已弃用的 WARNING。默认值为 on。","description_zh_html":"\u003cp\u003e\n        控制在 \u003ccode class=\"command\"\u003eCREATE ROLE\u003c/code\u003e 或 \u003ccode class=\"command\"\u003eALTER ROLE\u003c/code\u003e 语句设置\n        MD5 加密密码时，是否生成有关 MD5 密码已弃用的 \u003ccode class=\"literal\"\u003eWARNING\u003c/code\u003e。默认值为 \u003ccode class=\"literal\"\u003eon\u003c/code\u003e。\n       \u003c/p\u003e","doc":{"anchor":"GUC-MD5-PASSWORD-WARNINGS","file":"runtime-config-connection.html","lang":"en","sha256":"567ba928f3e4c4783f548dc8a54f1e748f02bbe163924605f2132eb5b0da440d","slug":"18"},"documented":true,"enumvals":null,"extra_desc":null,"lang":"en","max_val":null,"metadata_version":"18","min_val":null,"name":"md5_password_warnings","short_desc":"Enables deprecation warnings for MD5 passwords.","source":"pg-settings-source-snapshot","translation_provenance":{"inputs":[{"kind":"current-pgdoc-translation","path":"/Users/vonng/pgsty/pgdoc/zh/18/html/runtime-config-connection.html","sha256":"f4e5e4debc927cfa154bbdd71f3bf2eda8130ac3acace1109fe7d45ef2a3456b"}],"kind":"same-version-pgdoc","locale":"zh-Hans","source_revision":"b1b500221dbe5437cfca004d6b04d3f6e422765d","version":"18"},"unit":null,"vartype":"bool","zh_from":"same-version-pgdoc"},"ManualEvidence":{"doc":{"anchor":"GUC-MD5-PASSWORD-WARNINGS","file":"runtime-config-connection.html","lang":"en","sha256":"567ba928f3e4c4783f548dc8a54f1e748f02bbe163924605f2132eb5b0da440d","slug":"18"}},"MeasuredEvidence":{"metadata_version":"18"}},"Text":{"Collection":"guc","Key":"md5_password_warnings","SourceDatabase":"center","Version":"18","Locale":"en","Title":"md5_password_warnings","Summary":"Controls whether a WARNING about MD5 password deprecation is produced when a CREATE ROLE or ALTER ROLE statement sets an MD5-encrypted password. The default value is on.","BodyHTML":"\u003cp\u003eControls whether a WARNING about MD5 password deprecation is produced when a CREATE ROLE or ALTER ROLE statement sets an MD5-encrypted password. The default value is on.\u003c/p\u003e","SourceRevision":"wiki-repair-20261023:900fc5437fee147c7f400101e423310d34326eaf357754cdf9411c4d0b83b67e","ContentHash":"b5533de2093a4bbadeaf35d8fcc54316cd2bf3c99b266b2d5e89ed6e3907e09c","Payload":{"description":"Controls whether a WARNING about MD5 password deprecation is produced when a CREATE ROLE or ALTER ROLE statement sets an MD5-encrypted password. The default value is on."}},"RequestedLocale":"en","Fallback":false,"Versions":["18","19","20"],"Locales":["en","zh-Hans"],"Signatures":null,"Spellings":null,"SQLState":null,"Evidence":null}