# Should the password be plain text when creating a user through the API?

**URL:** <https://meta.discourse.org/t/should-the-password-be-plain-text-when-creating-a-user-through-the-api/66024>\
**Category:** Development\
**Created:** [7월 11, 2017, 11:33오후 UTC](https://meta.discourse.org/t/should-the-password-be-plain-text-when-creating-a-user-through-the-api/66024 "2017-07-11T23:33:11Z")\
**Posts on this page:** 1\
**Showing post:** 2

<div class="post-metadata">

**Author:** ![mpalmer](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/mpalmer/32/45740_2.png) [@mpalmer](https://meta.discourse.org/u/mpalmer)\
**Post date:** [7월 11, 2017, 11:44오후 UTC](https://meta.discourse.org/t/should-the-password-be-plain-text-when-creating-a-user-through-the-api/66024/2 "2017-07-11T23:44:12Z")

</div>

Yes, SSL is considered sufficient to protect secrets in-flight. Until the world sees the light and switches to something like TLS-SRP, sharing secrets over a secured channel are pretty much all we’ve got to work with.

---

_[View the full topic](https://meta.discourse.org/t/should-the-password-be-plain-text-when-creating-a-user-through-the-api/66024)._