PostgreSQL SCRAM-SHA-256 Password Hash Generator
Pre-hash a PostgreSQL password into the exact SCRAM-SHA-256 verifier format stored in pg_authid, then paste the generated CREATE ROLE or ALTER ROLE statement into your migration or provisioning script. The plaintext never appears in SQL, server logs or pg_stat_statements. You can also check whether a password matches an existing verifier. Hashing uses the browser's Web Crypto API; nothing is uploaded.
Do more than postgresql scram-sha-256 password hash generator — meet Chat2DB
Chat2DB is an AI-powered SQL client for Windows, macOS and Linux. Write SQL in natural language, format and optimize queries automatically, and manage MySQL, PostgreSQL, Oracle and 20+ other databases in one workspace.
How to use
- Enter the role name and password, and optionally change the iteration count (Postgres uses 4096 by default).
- Click Generate to get the SCRAM-SHA-256 verifier and the matching CREATE ROLE or ALTER ROLE statement.
- Run the SQL as a superuser or a role with CREATEROLE; use Verify mode to test a password against an existing verifier.
Frequently asked questions
Why pre-hash a Postgres password instead of sending it in plain text?
ALTER ROLE ... PASSWORD 'secret' puts the plaintext in the SQL text, where it can end up in server logs (log_statement), pg_stat_statements and shell history. If the password string is already a SCRAM-SHA-256 verifier, Postgres stores it as-is, and the plaintext never leaves the client. psql's \password command uses the same approach.
Is the generated hash compatible with every Postgres version?
SCRAM-SHA-256 verifiers work on PostgreSQL 10 and later, and it has been the default password_encryption since PostgreSQL 14. Clients need libpq 10+ or a driver with SCRAM support. Postgres 16 added the scram_iterations setting; a verifier stores its own iteration count, so a non-default count works on any version.
How do I manage roles and passwords without hand-writing SQL?
Chat2DB lets you connect to PostgreSQL, browse roles and grants, and have its AI assistant draft role, privilege and pg_hba changes for review before you run them. You can get it at chat2db.ai/download or use the web version.
