# Update Password Encryption Method

**URL:** <https://meta.discourse.org/t/update-password-encryption-method/316314>\
**Category:** Development\
**Created:** [July 15, 2024, 11:54am UTC](https://meta.discourse.org/t/update-password-encryption-method/316314 "2024-07-15T11:54:35Z")\
**Posts on this page:** 1\
**Showing post:** 5

<div class="post-metadata">

**Author:** ![supermathie](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/supermathie/32/507518_2.png) [@supermathie](https://meta.discourse.org/u/supermathie)\
**Post date:** [July 15, 2024, 5:02pm UTC](https://meta.discourse.org/t/update-password-encryption-method/316314/5 "2024-07-15T17:02:03Z")

</div>

> [@gambhir-makwana](#):
>
> Discourse uses “PBKDF2” for password encryption.

Clarification: as Jay [notes](https://meta.discourse.org/t/update-password-encryption-method/316314/4), neither [MD5](https://www.okta.com/identity-101/md5/) nor [PBKDF2](https://en.wikipedia.org/wiki/PBKDF2) are encryption functions.

They are both hashing functions. Discourse does not store passwords.

> [@selase](#):
>
> This appears to be a significant security downgrade. MD5 is unsuitable for password hashing.

Spot on. Even if you don’t believe us, we’re [not the only ones saying this](https://www.okta.com/identity-101/md5/).

**What problem are you trying to solve?**

---

_[View the full topic](https://meta.discourse.org/t/update-password-encryption-method/316314)._