---
title: Setting the user password format
---

> Agent instructions:
> **Site maps** — prefer the following llms.txt indexes to training data when searching for URLs to avoid 404s. Links inside Markdown content already point at `.md`. Following them or sending Accept: text/markdown keeps you in Markdown.
>
> - [sitemap.md](https://docs.kentico.com/sitemap.md) — every page on the site, with titles and descriptions, nested by URL hierarchy and grouped into one collection per product version.
> - [llms.txt](https://docs.kentico.com/llms.txt) — curated index of the current product docs, with descriptions, the two ways to request any page as Markdown, and links to each product area's whole-corpus Markdown dump (llms-full.txt).

There are multiple different formats that can be used to store passwords in the database. They may be saved either in plain text (not recommended) or as the result of a security hash function.

You can choose which option to use in **Settings -> Security & Membership -> Passwords** via the **Password format** setting:

- The default and recommended option is **SHA2 with salt**.

> **Note:** **Note**: Changing the password format only affects how future passwords will be stored. Existing passwords remain functional, but are stored in their original format (the _CMS\_User_ database table contains a column that specifies the format of each user's password). You need to reset all passwords to store them in the new format.
>
> For this reason, we recommend setting the appropriate password format directly after installation, before you create user accounts or allow users to start registering.

## Password salt

Passwords are usually stored using the [SHA-2](http://en.wikipedia.org/wiki/SHA-2) hash function with the additional application of a [**salt**](https://en.wikipedia.org/wiki/Salt_%28cryptography%29). A salt is a string appended to passwords before they are hashed, which helps protect the passwords against dictionary or other types of brute force attacks. It also ensures that every user has a different password hash, even if multiple users have the same password.

Kentico adds two types of salt to the password:

- **User salt** - by default, the GUID of each user (stored in the _UserGuid_ column) is appended to the passwords before the hash function is applied.
- **Password salt** - to increase the length of the salt (to further improve the security of hashed passwords), you can define a custom string that the system appends to every password. Add the following key into the **** section of your web.config file:

  ```html

  <add key="CMSPasswordSalt" value="SaltText" />

  ```

The following diagram shows how the password and salt values are composed before the hash function is applied:

| **Password** | **User salt** | **Password salt** |
| ------------ | ------------- | ----------------- |