I wan’t to know whether the admin has a way to view the forum user’s passwords & other info
AI-generated summary
In a support discussion titled “Is there a way to manually locate user’s passwords?”, users explore whether administrators can access or decrypt user passwords in Discourse. JSey clarifies that while user data is stored in the database, passwords are securely hashed and salted — making them irretrievable, not decryptable. purldator notes users can reset passwords themselves via “I forgot my password,” emphasizing admins should never need or know user passwords. Ramith asks if admins can decrypt hashes, to which Mittineague and sam respond negatively — hashes are designed to be one-way, and brute-forcing even a moderately strong password would take centuries with current hardware. elberet humorously shares a sample hash, reinforcing its impracticality to reverse. Stephen corrects terminology: hashing ≠ encryption. codinghorror adds that while 10-character passwords may be vulnerable, Discourse enforces longer minimums (10 for users, 15 for staff) and plans to increase hash difficulty. sam and OverseersMight discuss 2FA adoption, now enabled by default for staff. hello-smile6 questions SHA-256’s 2021 security; elberet explains that even the Bitcoin network’s immense power would require longer than the universe’s age to crack a full SHA-256 hash — making it safe unless a fundamental flaw is discovered. The consensus: passwords are secure, admins shouldn’t access them, and brute-forcing is futile.
If any user forgot their password they can retrieve it on their own.
“I forgot my password” They can click that and go through the prompts.
No admin needs to know the passwords of their users.
s/retrieve/reset/
You really cannot “retrieve” it. But you can get the system to let you choose another one.
Very true. I would extend that to “No admin should know…”
So can the admin decrypt it?
Is there a way to view the database in a readable format?
No
Only in as much that hashes are readable
You would need to brute force the hashed password, its using PBKDF2 - Wikipedia with a rather high number of iterations so you would probably be stuck only being able to test out a handful of passwords a second.
On current computing hardware if the user picked a reasonable password you are probably looking at a few centuries of computer work.
Don’t tempt him. We might be dealing with a Super Elite Class I Hacker.
11 Likes
Awesome!
what a great challenge .. 
It’s a hash, it’s not encrypted. Encryption is reversible, hashing is not.
Depends, if you know that the cleartext is shorter than the hash blocklength, the hash is reversible. We just hope that noone ever finds an efficient (i.e. deterministic polynomial) reverse function. 
Ok, “hope” is not exactly true. Cryptologists are fairly certain that for SHA2 no such function exists for current hardware.
Not exactly, minimum default password length today is 10 for regular users and 15 for staff. A weak 10 char password wouldn’t be terribly hard to break. See data at
We still need to create a password hash version and ramp up the hash difficulty a fair bit before 2020.
Not against ramping up hash difficulty by 2020 at all, but the most enormous risk will remain the “previously hacked list of passwords” that is constantly expanding, hopefully by 2020 we can go for 2fa by default and at least mitigate more of this long term
Looks like that didn’t end up happening.
For anyone out there, don’t change your discourse instance’s password length to 8 digits, it will only lead to unhappy people. (I tested it, and if I can crack it, anyone can.)
Actually this is mostly done, the setting enforce_second_factor is enabled by default on all new instances for staff.
Existing instances of Discourse can toggle the setting to staff.