# Database user authentication password encryption

**URL:** <https://forum.inductiveautomation.com/t/database-user-authentication-password-encryption/10552>\
**Category:** Ignition\
**Created:** [September 30, 2015, 10:14am UTC](https://forum.inductiveautomation.com/t/database-user-authentication-password-encryption/10552 "2015-09-30T10:14:09Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![gnguyen](https://avatars.discourse-cdn.com/v4/letter/g/41988e/32.png) [@gnguyen](https://forum.inductiveautomation.com/u/gnguyen)\
**Post date:** [September 30, 2015, 10:14am UTC](https://forum.inductiveautomation.com/t/database-user-authentication-password-encryption/10552/1 "2015-09-30T10:14:09Z")

</div>

Hi,

How is encrypted the password when using database profile? I tried to decode using SHA1 or MD5 but can’t find the same code.

Help is welcome.

Best.

---

<div class="post-metadata">

**Author:** ![AlThePal](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/althepal/32/3603_2.png) [@AlThePal](https://forum.inductiveautomation.com/u/AlThePal)\
**Post date:** [September 30, 2015, 6:36pm UTC](https://forum.inductiveautomation.com/t/database-user-authentication-password-encryption/10552/2 "2015-09-30T18:36:02Z")

</div>

The example Authentication Query for Manual Mode is `SELECT firstname, lastname, schedule FROM USERS WHERE username = ? AND password = MD5(?)`so I’m guessing MD5…

---

<div class="post-metadata">

**Author:** ![Carl.Gould](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/carl.gould/32/7262_2.png) [@Carl.Gould](https://forum.inductiveautomation.com/u/Carl.Gould)\
**Post date:** [October 1, 2015, 3:34pm UTC](https://forum.inductiveautomation.com/t/database-user-authentication-password-encryption/10552/3 "2015-10-01T15:34:17Z")

</div>

It’s sha1 for the automatic mode DB user source

---

<div class="post-metadata">

**Author:** ![AlThePal](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/althepal/32/3603_2.png) [@AlThePal](https://forum.inductiveautomation.com/u/AlThePal)\
**Post date:** [October 1, 2015, 3:36pm UTC](https://forum.inductiveautomation.com/t/database-user-authentication-password-encryption/10552/4 "2015-10-01T15:36:16Z")

</div>

Oh well. Now you know why I don’t do the lottery 🙂

---

<div class="post-metadata">

**Author:** ![Jim\_Jensen](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/jim_jensen/32/3317_2.png) [@Jim\_Jensen](https://forum.inductiveautomation.com/u/Jim_Jensen)\
**Post date:** [October 13, 2016, 6:17pm UTC](https://forum.inductiveautomation.com/t/database-user-authentication-password-encryption/10552/5 "2016-10-13T18:17:32Z")

</div>

Database passwords are a 64-bit SHA1 hash when using automatic mode.

This following example could be used to allow a user to change their password from the client:

```auto
import base64
import hashlib

user = system.security.getUsername()
pwd = "myPassword"
hash = base64.b64encode(hashlib.sha1(pwd).digest())

result = system.db.runUpdateQuery("UPDATE auth_users SET passwd = '%s' WHERE username = '%s'" % (hash, user)
```

---

<div class="post-metadata">

**Author:** ![WeiLiang.Yee](https://avatars.discourse-cdn.com/v4/letter/w/22d042/32.png) [@WeiLiang.Yee](https://forum.inductiveautomation.com/u/WeiLiang.Yee)\
**Post date:** [May 9, 2018, 9:01am UTC](https://forum.inductiveautomation.com/t/database-user-authentication-password-encryption/10552/6 "2018-05-09T09:01:33Z")

</div>

Hi, found this thread while looking for information. Thanks for the hashing function. However, is there a way to reverse it? As I’m developing a custom login screen and will need to switch user using scripting. Thank you.

---

<div class="post-metadata">

**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\
**Post date:** [May 9, 2018, 12:32pm UTC](https://forum.inductiveautomation.com/t/database-user-authentication-password-encryption/10552/7 "2018-05-09T12:32:25Z")

</div>

Hashes are non-reversible. That’s the point of using them in security applications. Your custom login screen should be asking the user for his/her password.