# Is there a way to manually locate user's passwords?
**URL:** https://meta.discourse.org/t/is-there-a-way-to-manually-locate-users-passwords/25492
**Category:** Support
**Created:** [21 februari 2015 om 18:03 UTC](https://meta.discourse.org/t/is-there-a-way-to-manually-locate-users-passwords/25492 "2015-02-21T18:03:23Z")
**Posts on this page:** 20
**Page:** 1
### Author:  [@Ramith](https://meta.discourse.org/u/Ramith)
#### Post date: [21 februari 2015 om 18:03 UTC](https://meta.discourse.org/t/is-there-a-way-to-manually-locate-users-passwords/25492/1 "2015-02-21T18:03:23Z")
I wan’t to know whether the admin has a way to view the forum user’s passwords & other info
---
### Author:  [@JSey](https://meta.discourse.org/u/JSey)
#### Post date: [21 februari 2015 om 18:20 UTC](https://meta.discourse.org/t/is-there-a-way-to-manually-locate-users-passwords/25492/2 "2015-02-21T18:20:02Z")
Other info? Sure, all stored in the database. The passwords too, but [hashed](http://en.wikipedia.org/wiki/Cryptographic_hash_function) and [salted](http://en.wikipedia.org/wiki/Salt_%28cryptography%29) - which boils down to a simple: “¡No way, señor!”
---
### Author:  [@purldator](https://meta.discourse.org/u/purldator)
#### Post date: [21 februari 2015 om 20:56 UTC](https://meta.discourse.org/t/is-there-a-way-to-manually-locate-users-passwords/25492/3 "2015-02-21T20:56:28Z")
If any user forgot their password they can retrieve it on their own.
[ ](https://i.imgur.com/removed.png)
**“I forgot my password”** They can click that and go through the prompts.
No admin needs to know the passwords of their users.
---
### Author:  [@JSey](https://meta.discourse.org/u/JSey)
#### Post date: [21 februari 2015 om 21:33 UTC](https://meta.discourse.org/t/is-there-a-way-to-manually-locate-users-passwords/25492/4 "2015-02-21T21:33:53Z")
> [@purldator](#):
>
> If any user forgot their password they can retrieve it on their own.
`s/retrieve/reset/`
You really cannot “retrieve” it. But you can get the system to let you choose another one.
> [@purldator](#):
>
> No admin needs to know the passwords of their users.
Very true. I would extend that to “No admin **should** know…”
---
### Author:  [@Ramith](https://meta.discourse.org/u/Ramith)
#### Post date: [22 februari 2015 om 03:42 UTC](https://meta.discourse.org/t/is-there-a-way-to-manually-locate-users-passwords/25492/5 "2015-02-22T03:42:24Z")
So can the admin decrypt it?
---
### Author:  [@Ramith](https://meta.discourse.org/u/Ramith)
#### Post date: [22 februari 2015 om 03:43 UTC](https://meta.discourse.org/t/is-there-a-way-to-manually-locate-users-passwords/25492/6 "2015-02-22T03:43:40Z")
Is there a way to view the database in a readable format?
---
### Author:  [@Mittineague](https://meta.discourse.org/u/Mittineague)
#### Post date: [22 februari 2015 om 03:45 UTC](https://meta.discourse.org/t/is-there-a-way-to-manually-locate-users-passwords/25492/7 "2015-02-22T03:45:39Z")
> [@Ramith](#):
>
> So can the admin decrypt it?
No
> [@Ramith](#):
>
> Is there a way to view the database in a readable format?
Only in as much that hashes are readable
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [22 februari 2015 om 05:37 UTC](https://meta.discourse.org/t/is-there-a-way-to-manually-locate-users-passwords/25492/9 "2015-02-22T05:37:22Z")
You would need to brute force the hashed password, its using [PBKDF2 - Wikipedia](http://en.wikipedia.org/wiki/PBKDF2) with a rather high number of iterations so you would probably be stuck only being able to test out a handful of passwords a second.
On current computing hardware if the user picked a reasonable password you are probably looking at a few centuries of computer work.
---
### Author:  [@elberet](https://meta.discourse.org/u/elberet)
#### Post date: [22 februari 2015 om 10:33 UTC](https://meta.discourse.org/t/is-there-a-way-to-manually-locate-users-passwords/25492/10 "2015-02-22T10:33:26Z")
Sure, install Discourse in dev mode or, _not recommended_, export your production Discourse’s PostgreSQL’s port and poke a hole in your firewall, then connect with [pgAdmin](http://www.pgadmin.org/) and have a look around.
Oh and just to illustrate @sam’s point:
This is my password. Have fun trying to decrypt that. 🙂
---
### Author:  [@purldator](https://meta.discourse.org/u/purldator)
#### Post date: [22 februari 2015 om 10:56 UTC](https://meta.discourse.org/t/is-there-a-way-to-manually-locate-users-passwords/25492/11 "2015-02-22T10:56:17Z")
Don’t tempt him. We might be dealing with a _[Super Elite Class I Hacker](http://hackertyper.net/)_.
---
### Author:  [@elberet](https://meta.discourse.org/u/elberet)
#### Post date: [22 februari 2015 om 11:08 UTC](https://meta.discourse.org/t/is-there-a-way-to-manually-locate-users-passwords/25492/12 "2015-02-22T11:08:35Z")
---
### Author:  [@Ramith](https://meta.discourse.org/u/Ramith)
#### Post date: [22 februari 2015 om 17:24 UTC](https://meta.discourse.org/t/is-there-a-way-to-manually-locate-users-passwords/25492/13 "2015-02-22T17:24:53Z")
Awesome!
what a great challenge .. 🙂
---
### Author:  [@Stephen](https://meta.discourse.org/u/Stephen)
#### Post date: [29 april 2015 om 12:25 UTC](https://meta.discourse.org/t/is-there-a-way-to-manually-locate-users-passwords/25492/14 "2015-04-29T12:25:11Z")
It’s a hash, it’s not encrypted. Encryption is reversible, hashing is not.
---
### Author:  [@elberet](https://meta.discourse.org/u/elberet)
#### Post date: [29 april 2015 om 14:27 UTC](https://meta.discourse.org/t/is-there-a-way-to-manually-locate-users-passwords/25492/15 "2015-04-29T14:27:00Z")
Depends, if you know that the cleartext is shorter than the hash blocklength, the hash _is_ reversible. We just _hope_ that noone ever finds an efficient (i.e. deterministic polynomial) reverse function. 😉
Ok, “hope” is not exactly true. Cryptologists are fairly certain that for SHA2 no such function exists for current hardware.
---
### Author:  [@system](https://meta.discourse.org/u/system)
#### Post date: [29 september 2018 om 16:29 UTC](https://meta.discourse.org/t/is-there-a-way-to-manually-locate-users-passwords/25492/16 "2018-09-29T16:29:05Z")
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [29 september 2018 om 16:32 UTC](https://meta.discourse.org/t/is-there-a-way-to-manually-locate-users-passwords/25492/17 "2018-09-29T16:32:20Z")
> [@sam](#):
>
> On current computing hardware if the user picked a reasonable password you are probably looking at a few centuries of computer work.
Not exactly, minimum default password length today is 10 for regular users and 15 for staff. A weak 10 char password wouldn’t be terribly hard to break. See data at
> **[Hacker, Hack Thyself](https://blog.codinghorror.com/hacker-hack-thyself/)**
>
> We’ve read so many sad stories about communities that were fatally compromised or destroyed due to security exploits. We took that lesson to heart when we founded the Discourse project; we endeavor to build open source software that is secure and...
We still need to create a password hash version and ramp up the hash difficulty a fair bit before 2020.
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [30 september 2018 om 09:22 UTC](https://meta.discourse.org/t/is-there-a-way-to-manually-locate-users-passwords/25492/18 "2018-09-30T09:22:22Z")
Not against ramping up hash difficulty by 2020 at all, but the most enormous risk will remain the “previously hacked list of passwords” that is constantly expanding, hopefully by 2020 we can go for 2fa by default and at least mitigate more of this long term
---
### Author:  [@system](https://meta.discourse.org/u/system)
#### Post date: [14 juni 2021 om 13:27 UTC](https://meta.discourse.org/t/is-there-a-way-to-manually-locate-users-passwords/25492/19 "2021-06-14T13:27:35Z")
---
### Author:  [@OverseersMight](https://meta.discourse.org/u/OverseersMight)
#### Post date: [13 september 2021 om 20:11 UTC](https://meta.discourse.org/t/is-there-a-way-to-manually-locate-users-passwords/25492/20 "2021-09-13T20:11:46Z")
> [@sam](#):
>
> hopefully by 2020 we can go for 2fa by default
Looks like that didn’t end up happening.
For anyone out there, don’t change your discourse instance’s password length to 8 digits, it will only lead to unhappy people. (I tested it, and if I can crack it, anyone can.)
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [12 oktober 2021 om 00:45 UTC](https://meta.discourse.org/t/is-there-a-way-to-manually-locate-users-passwords/25492/21 "2021-10-12T00:45:18Z")
> [@OverseersMight](#):
>
> Looks like that didn’t end up happening.
Actually this is mostly done, the setting `enforce_second_factor` is enabled by default on all new instances for `staff`.
Existing instances of Discourse can toggle the setting to `staff`.
[Volgende pagina](https://meta.discourse.org/t/is-there-a-way-to-manually-locate-users-passwords/25492.md?page=2)