# Password hash algorithm

**URL:** https://meta.discourse.org/t/password-hash-algorithm/128608
**Category:** Development
**Created:** [September 15, 2019, 12:17am UTC](https://meta.discourse.org/t/password-hash-algorithm/128608 "2019-09-15T00:17:22Z")
**Posts on this page:** 1
**Showing post:** 10

<div class="post-metadata">

### Author: ![lcb](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/lcb/32/217689_2.png) [@lcb](https://meta.discourse.org/u/lcb)
#### Post date: [May 14, 2021, 8:26am UTC](https://meta.discourse.org/t/password-hash-algorithm/128608/10 "2021-05-14T08:26:31Z")

</div>

Hi,  
I’d be interested in knowing what password hash function and associated parameters (hash length, salt, what actual library is called) are used for local login. Looking at the ruby file mentioned earlier didn’t help me. I’m in need of this info for compliance purposes: best practices around GPDR (and in the general realm of systems security, really) require me to document this information.

Edit: found the answer here: [Export password hashes in the PHC format](https://meta.discourse.org/t/export-password-hashes-in-the-phc-format/133805) → [discourse/docs/SECURITY.md at main · discourse/discourse · GitHub](https://github.com/discourse/discourse/blob/master/docs/SECURITY.md)

---

_[View the full topic](https://meta.discourse.org/t/password-hash-algorithm/128608)._