# Migrated password hashes support

**URL:** https://meta.discourse.org/t/migrated-password-hashes-support/19512
**Category:** Plugin
**Created:** [September 1, 2014, 5:51pm UTC](https://meta.discourse.org/t/migrated-password-hashes-support/19512 "2014-09-01T17:51:25Z")
**Posts on this page:** 1
**Showing post:** 36

<div class="post-metadata">

### Author: ![RGJ](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/rgj/32/523185_2.png) [@RGJ](https://meta.discourse.org/u/RGJ)
#### Post date: [June 2, 2026, 1:17pm UTC](https://meta.discourse.org/t/migrated-password-hashes-support/19512/36 "2026-06-02T13:17:31Z")

</div>

> [@uckelman](#):
>
> Is there a way to check how many of our users are still using the legacy password hashes from our old forum?

Technically, a user is not “using” the legacy password hash.

When a user logs in for the first time after a migration, and the password does not match the Discourse password (which will be a random string of characters initially), the plugin does its work.

- it checks if the entered password does match the `import_pass` custom fields using all hash methods it knows about
- if it finds a match, it saves the password to the user and then removes the `import_pass` custom field.

So after a few years, only the users who did not “use” the migrated password to login will still have a `import_pass` custom field.

a) they never logged in (you can check that with the last seen date)  
b) they didn’t use the migrated password but logged in using email, a different auth method, or they have reset their password

⚠ I just realized that situation b can introduce a security issue. If a user does not remember their password and changes it, or if they use another auth method, the migrated password hash will still be there and can still be used next to the new password. I have just pushed an update to the plugin so it clears the `import_pass` custom field on _every_ successful login.

So going forward, the `import_pass` custom field will only be there for users who never logged in.

---

_[View the full topic](https://meta.discourse.org/t/migrated-password-hashes-support/19512)._