Password authentication methods in PostgreSQL

Introduction

Password authentication methods help keep your database safe by checking if users provide the right password before they can connect.

When you want to control who can access your database.

When you need to make sure only authorized users can run queries.

When setting up a new database user with a password.

When changing how users log in to improve security.

When troubleshooting login problems related to passwords.

Syntax

PostgreSQL

METHOD = 'password' | 'md5' | 'scram-sha-256' | 'peer' | 'ident' | 'trust' | ...

This syntax is used in the pg_hba.conf file to set authentication methods.

Common password methods are password, md5, and scram-sha-256.

Examples

Require MD5 hashed password for all users connecting from any IP address.

PostgreSQL

host all all 0.0.0.0/0 md5

Require SCRAM-SHA-256 password authentication for users from the local network.

PostgreSQL

host all all 192.168.1.0/24 scram-sha-256

Use peer authentication for local connections (checks OS user name).

PostgreSQL

local all all peer

Sample Program

This example sets the password authentication method to SCRAM-SHA-256 for all users connecting from any IP address. After editing pg_hba.conf, you reload the configuration to apply changes.

PostgreSQL

# In pg_hba.conf file
host all all 0.0.0.0/0 scram-sha-256

-- Then reload PostgreSQL configuration
SELECT pg_reload_conf();

Important Notes

MD5 is older and less secure than SCRAM-SHA-256, which is recommended for new setups.

Always reload or restart PostgreSQL after changing authentication methods in pg_hba.conf.

Using trust means no password is needed, which is unsafe for production.

Summary

Password authentication methods protect your database by requiring users to prove their identity.

Common methods include md5 and scram-sha-256, with SCRAM being more secure.

Set these methods in pg_hba.conf and reload PostgreSQL to apply changes.