# Password hash algorithm

**URL:** <https://meta.discourse.org/t/password-hash-algorithm/128608>\
**Category:** Development\
**Created:** [September 15, 2019, 12:17am UTC](https://meta.discourse.org/t/password-hash-algorithm/128608 "2019-09-15T00:17:22Z")\
**Posts on this page:** 1\
**Showing post:** 5

<div class="post-metadata">

**Author:** ![Stephen](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/stephen/32/95011_2.png) [@Stephen](https://meta.discourse.org/u/Stephen)\
**Post date:** [September 15, 2019, 2:31am UTC](https://meta.discourse.org/t/password-hash-algorithm/128608/5 "2019-09-15T02:31:04Z")

</div>

Yes, discourse is able to be authoritative for sign-in and this is the correct path @csmu - Attempting to duplicate the hashing method would mean your sign-in method will break every time it changes.

It also wouldn’t account for users who don’t have a local password.

---

_[View the full topic](https://meta.discourse.org/t/password-hash-algorithm/128608)._