# Should the password be plain text when creating a user through the API?
**URL:** https://meta.discourse.org/t/should-the-password-be-plain-text-when-creating-a-user-through-the-api/66024
**Category:** Development
**Created:** [July 11, 2017, 11:33pm UTC](https://meta.discourse.org/t/should-the-password-be-plain-text-when-creating-a-user-through-the-api/66024 "2017-07-11T23:33:11Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@mikeredick](https://meta.discourse.org/u/mikeredick)
#### Post date: [July 11, 2017, 11:33pm UTC](https://meta.discourse.org/t/should-the-password-be-plain-text-when-creating-a-user-through-the-api/66024/1 "2017-07-11T23:33:12Z")
I’m creating a small windows application that will use Discourse as the SSO provider. The first step in that chain is allowing the app to create a user through the Discourse API.
I’ve got that working, however it seems that the password for the user is passed in plain text and I’m wondering why that is? It seems like that could be a security issue… is the thought just that people should use SSL and that’s good enough to protect the password?
---
### Author:  [@mpalmer](https://meta.discourse.org/u/mpalmer)
#### Post date: [July 11, 2017, 11:44pm UTC](https://meta.discourse.org/t/should-the-password-be-plain-text-when-creating-a-user-through-the-api/66024/2 "2017-07-11T23:44:12Z")
Yes, SSL is considered sufficient to protect secrets in-flight. Until the world sees the light and switches to something like TLS-SRP, sharing secrets over a secured channel are pretty much all we’ve got to work with.
---
### Author:  [@Siddhu\_Dhangar](https://meta.discourse.org/u/Siddhu_Dhangar)
#### Post date: [June 15, 2020, 5:39pm UTC](https://meta.discourse.org/t/should-the-password-be-plain-text-when-creating-a-user-through-the-api/66024/3 "2020-06-15T17:39:12Z")
Can we send encrypted password instead of plain text password ?
---
### Author:  [@Siddhu\_Dhangar](https://meta.discourse.org/u/Siddhu_Dhangar)
#### Post date: [June 16, 2020, 2:03pm UTC](https://meta.discourse.org/t/should-the-password-be-plain-text-when-creating-a-user-through-the-api/66024/4 "2020-06-16T14:03:45Z")
is there any way to pass an encrypted password instead of plain text password ? we are developing one app in which we are using /session api for checking authentication of the user. where username and password need to be submitted. i noticed one thing that lets say if you go to browsers developer tool , where you can actually see your plaintext password which we pass while logging. so if anybody has my laptop access, then password may get hacked right.
---
### Author:  [@RGJ](https://meta.discourse.org/u/RGJ)
#### Post date: [June 16, 2020, 2:16pm UTC](https://meta.discourse.org/t/should-the-password-be-plain-text-when-creating-a-user-through-the-api/66024/5 "2020-06-16T14:16:56Z")
If SSO is enabled, the password is not being used at all, so this is not an issue.
Just provide some random characters.
---
### Author:  [@spirobel](https://meta.discourse.org/u/spirobel)
#### Post date: [June 16, 2020, 2:22pm UTC](https://meta.discourse.org/t/should-the-password-be-plain-text-when-creating-a-user-through-the-api/66024/6 "2020-06-16T14:22:23Z")
if you want to go the extra mile, you can do certificate pinning in your APP to make sure there is no man in the middle attack.
---
### Author:  [@mpalmer](https://meta.discourse.org/u/mpalmer)
#### Post date: [June 19, 2020, 2:57am UTC](https://meta.discourse.org/t/should-the-password-be-plain-text-when-creating-a-user-through-the-api/66024/7 "2020-06-19T02:57:04Z")
> [@Siddhu\_Dhangar](#):
>
> is there any way to pass an encrypted password instead of plain text password ?
As long as you’re using TLS, passwords are sent encrypted. If you’re not using TLS, you’re on a fast train to doom regardless.
If you meant “hashed” rather than “encrypted”, then no, that is not a supported configuration, because the hashing mechanism used within Discourse is not a part of the public interface contract, and is subject to change at any time.
> [@Siddhu\_Dhangar](#):
>
> i noticed one thing that lets say if you go to browsers developer tool , where you can actually see your plaintext password which we pass while logging. so if anybody has my laptop access, then password may get hacked right.
Well, yes, but if someone’s got access to your laptop, they can just drop a keylogger that captures the password before it goes through any hashing process. The security threat model of Discourse (and every single web application) includes the stipulation that the endpoint is not compromised.