Encrypted PostgreSQL Password

Table of Contents

• Purpose
• Usage
• References

Purpose

The PostgreSQL documentation of CREATE ROLE mentions:

If the presented password string is already in MD5-encrypted or SCRAM-encrypted format, then it is stored as-is regardless of password_encryption (since the system cannot decrypt the specified encrypted password string, to encrypt it in a different format).

Which is not only useful during dump and restore, but also when initializing a new installation.

This is a simple tool to create SCRAM-SHA-256 encrypted passwords.

Usage

./pgpasswd.sh user pass

outputs

CREATE ROLE "user" WITH
  LOGIN
  PASSWORD 'SCRAM-SHA-256$4096:...';

which can be fed directly into PostgreSQL.

References

• RFC 7677 SCRAM-SHA-256

• RFC 5802 SCRAM Algorithm Overview