--- title: Supported Password Hashing and Verification Algorithms in ZITADEL Cloud description: Discover the password verification algorithms supported across all ZITADEL Cloud regions, how legacy credentials migrate seamlessly, and how transparent re-hashing to bcrypt works. --- [Skip to content](https://help.zitadel.com/supported-password-verifiers-zitadel-cloud#main-content) [![zitadel-logo\_text-dark (1)](https://help.zitadel.com/hs-fs/hubfs/zitadel-logo_text-dark%20(1).png?width=210&height=60&name=zitadel-logo_text-dark%20(1).png)](https://help.zitadel.com/?hsLang=en) Open main navigation Close main navigation - [Documentation](https://zitadel.com/docs) [Documentation](https://zitadel.com/docs) How can we help you? - There are no suggestions because the search field is empty. 1. [ZITADEL Knowledge Base](https://help.zitadel.com/?hsLang=en) 2. [User Management](https://help.zitadel.com/user-management?hsLang=en) November 9, 2026 # Supported Password Hashing and Verification Algorithms in ZITADEL Cloud ## An overview of active password verifiers across all cloud regions, hash format requirements for migration, and automatic re-hashing to bcrypt. When migrating existing users to ZITADEL Cloud or integrating legacy credential stores, you do not need to force users to reset their passwords. ZITADEL Cloud natively supports multiple standard password verification algorithms, allowing existing hashes to be verified and automatically upgraded upon the user's first login. All active verifiers—including **`pbkdf2`**, **`bcrypt`**, and **`scrypt`**—are uniformly enabled across all ZITADEL Cloud regions. ### Cloud Password Hasher & Verifier Configuration ZITADEL Cloud production environments use a standardized, hardened password hashing configuration: | Component | Setting | Description | | --- | --- | --- | | **Primary Hasher** | `bcrypt` (Cost: 12) | Standard algorithm used for all new user sign-ups, password changes, and re-hashed credentials. | | **Active Verifiers** | `bcrypt` `pbkdf2` `scrypt` `md5` `md5plain` `md5salted` | Enabled across all cloud regions to validate legacy passwords during user authentication. | ### Supported Verifier Algorithms ZITADEL Cloud can authenticate credentials stored in any of the following formats: - **`bcrypt`**: Standard bcrypt password hashes. - **`pbkdf2`**: Key derivation hashes utilizing standard pseudorandom functions (such as SHA-256 or SHA-512) structured in PHC format. - **`scrypt`**: Memory-hard key derivation hashes structured in PHC format. - **`md5`**: `md5Crypt` algorithm with salt and byte shuffling (standard Unix/Apache modular crypt format `$1$`). - **`md5plain`**: Hexadecimal or base64 MD5 digest of a password without salt. - **`md5salted`**: MD5 digest of a concatenated password and salt. ### Transparent Re-Hashing (Passwap) ZITADEL uses an integrated hashing library, [Passwap](https://github.com/zitadel/passwap), to manage password lifecycle and cryptographic upgrades seamlessly: **User Import:** You import user records with their existing legacy hashes via the ZITADEL Management API or Console. 1. **First Authentication:** The user logs in with their existing plaintext password. ZITADEL matches the credentials against the appropriate active verifier. 2. **Automatic Upgrade:** Because the stored hash differs from the primary hasher configuration (`bcrypt`, cost 12), ZITADEL transparently re-hashes the valid plaintext password to bcrypt and updates the record in the event store. 3. **Subsequent Logins:** Future authentications are evaluated directly against the modern `bcrypt` hash. ### Frequently Asked Questions #### Do users need to reset their passwords after migration? No. Provided the imported hashes conform to standard PHC or modular crypt formats matching the active verifiers, users can immediately authenticate with their existing credentials. #### Can we change the default primary hasher in ZITADEL Cloud? No. In ZITADEL Cloud, the primary hasher is standardized to `bcrypt` (cost 12) to ensure a uniform security and performance baseline across our shared infrastructure. Organizations requiring custom hasher algorithms or specific parameters (such as Argon2id) can deploy [Self-Hosted ZITADEL](https://zitadel.com/docs/self-hosting/deploy/overview), where `zitadel.yaml` is fully configurable. ### Related Documentation - [ZITADEL Architecture: Secrets and Hashing](https://zitadel.com/docs/concepts/architecture/secrets) - [Importing Users via ZITADEL APIs](https://zitadel.com/docs/apis/introduction) - [Passwap Library on GitHub](https://github.com/zitadel/passwap) - [Getting Started](https://help.zitadel.com/getting-started?hsLang=en) - [User Management](https://help.zitadel.com/user-management?hsLang=en) - [Authentication & Login](https://help.zitadel.com/authentication-login?hsLang=en) - [Security & Compliance](https://help.zitadel.com/security-compliance?hsLang=en) - [Troubleshooting](https://help.zitadel.com/troubleshooting?hsLang=en) - [Account & Subscription](https://help.zitadel.com/account-subscription?hsLang=en#main-content) - [Support](https://help.zitadel.com/account-subscription?hsLang=en#support) - [Billing (Pro)](https://help.zitadel.com/account-subscription?hsLang=en#billing-pro) - [Billing (Enterprise)](https://help.zitadel.com/account-subscription?hsLang=en#billing-enterprise) - [Zitadel Cloud Account](https://help.zitadel.com/account-subscription?hsLang=en#zitadel-cloud-account) - [Service Description](https://help.zitadel.com/account-subscription?hsLang=en#service-description) - [Default Settings](https://help.zitadel.com/default-settings?hsLang=en#main-content) - [Web Keys](https://help.zitadel.com/default-settings?hsLang=en#web-keys) - [Self-Hosting](https://help.zitadel.com/self-hosting?hsLang=en) [![zitadel-logo\_text-dark](https://help.zitadel.com/hs-fs/hubfs/zitadel-logo_text-dark.png?width=210&height=60&name=zitadel-logo_text-dark.png "zitadel-logo_text-dark")](http://zitadel.com) 1 Embarcadero Center, Suite 1200 San Francisco, CA 94111 Copyright © 2025 All rights reserved.