# Hash algorithm for storing password in internal DB

**URL:** <https://forum.inductiveautomation.com/t/hash-algorithm-for-storing-password-in-internal-db/54015>\
**Category:** Ignition\
**Tags:** ignition81\
**Created:** [December 11, 2021, 5:50pm UTC](https://forum.inductiveautomation.com/t/hash-algorithm-for-storing-password-in-internal-db/54015 "2021-12-11T17:50:14Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![Neo](https://avatars.discourse-cdn.com/v4/letter/n/9fc348/32.png) [@Neo](https://forum.inductiveautomation.com/u/Neo)\
**Post date:** [December 11, 2021, 5:50pm UTC](https://forum.inductiveautomation.com/t/hash-algorithm-for-storing-password-in-internal-db/54015/1 "2021-12-11T17:50:14Z")

</div>

I want to save the password for configuration setting (e.g. new SMTP profile). If I write insert plain text for password column in `SMTPSETTINGS` table of internal database I get no error but going back to Email Settings option on gateway webpage shows Internal Error.  
 ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/1/2/12dc6dbe9303f771f443c4d394541470dababe96.png)

Skipping password column in insert query does create a new SMTP profile. So I think I need to encrypt the plain text before inserting the value.

 ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/a/d/adb56f4eb16b1f66b336efb6c8deb5fee09e29e3.png)

I tried SHA1 algorithm to encrypt the password (‘password’) and inserted in internal DB table. It gets inserted as below but I get _Internal Error_

```auto
import base64
import hashlib

hash = base64.b64encode(hashlib.sha1('password').digest())

query = '''INSERT INTO SMTPSETTINGS (SMTPSETTINGS_ID, NAME, DESCRIPTION, HOSTNAME, PORT, USESSLPORT, SSLENABLED, USERNAME, PASSWORD, SMTPTIMEOUT, DEBUGMODEENABLED, SSLPROTOCOLS)
		   VALUES(3, 'SMTP6', '', '192.168.1.3', 25, True, True, 'user', ?, 10000, FALSE, 'TLSv1.2')'''
system.db.runPrepUpdate(query, [hash], 'InternalDB')

```

 ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/4/d/4d61ef6fed0c551eabbb5c3823567da0aa5d47ea.png)

In above table both SMTP5 and SMTP6 have same password ‘password’, so SHA1 is not the correct encryption. MD5 encryption returns ‘X03MO1qnZdYdgyfeuILPmQ==’ for ‘password’ and give the same _Internal Error_ on adding to database.

Is there any way to find which encryption algorithm is used?

---

<div class="post-metadata">

**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\
**Post date:** [December 11, 2021, 6:20pm UTC](https://forum.inductiveautomation.com/t/hash-algorithm-for-storing-password-in-internal-db/54015/2 "2021-12-11T18:20:13Z")

</div>

These passwords aren’t hashed, they are obfuscated via symmetric encryption using a “hidden” key and then encoded in hex.

You can import `com.inductiveautomation.ignition.common.GatewaySec` and use the encrypt/decrypt methods instead of trying to do it yourself.

[https://files.inductiveautomation.com/sdk/javadoc/ignition81/8.1.11/com/inductiveautomation/ignition/common/GatewaySec.html](https://files.inductiveautomation.com/sdk/javadoc/ignition81/8.1.11/com/inductiveautomation/ignition/common/GatewaySec.html)

---

<div class="post-metadata">

**Author:** ![Neo](https://avatars.discourse-cdn.com/v4/letter/n/9fc348/32.png) [@Neo](https://forum.inductiveautomation.com/u/Neo)\
**Post date:** [December 13, 2021, 9:06am UTC](https://forum.inductiveautomation.com/t/hash-algorithm-for-storing-password-in-internal-db/54015/3 "2021-12-13T09:06:26Z")

</div>

@Kevin.Herron Thanks for your prompt reply. It resolved the issue.

---

<div class="post-metadata">

**Author:** ![mvenegas](https://avatars.discourse-cdn.com/v4/letter/m/6f9a4e/32.png) [@mvenegas](https://forum.inductiveautomation.com/u/mvenegas)\
**Post date:** [December 30, 2021, 2:00am UTC](https://forum.inductiveautomation.com/t/hash-algorithm-for-storing-password-in-internal-db/54015/4 "2021-12-30T02:00:20Z")

</div>

Is this the same for a DB user source in auto mode? What I am trying to do is to reuse tha same users and password table to login into a .NET app. is it posible? or do I have to change the DB user source to manual mode?

I am working with a SQLSERVER 2012 as database

Regards

---

<div class="post-metadata">

**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\
**Post date:** [December 30, 2021, 2:34am UTC](https://forum.inductiveautomation.com/t/hash-algorithm-for-storing-password-in-internal-db/54015/5 "2021-12-30T02:34:31Z")

</div>

The reversible encryption is for use where Ignition must present the password to an external service via that service’s API. Even when the plaintext doesn’t cross the wires, it is usually required in a challenge-response exchange.

For user sources, Ignition is the “receiving” API and can therefore save user passwords as salted hashes. So, no.

---

<div class="post-metadata">

**Author:** ![mvenegas](https://avatars.discourse-cdn.com/v4/letter/m/6f9a4e/32.png) [@mvenegas](https://forum.inductiveautomation.com/u/mvenegas)\
**Post date:** [December 30, 2021, 10:34pm UTC](https://forum.inductiveautomation.com/t/hash-algorithm-for-storing-password-in-internal-db/54015/6 "2021-12-30T22:34:10Z")

</div>

Thank you Mr Turmel. It is clear now.  
I must say that all your aswer are always enlightening.

---

<div class="post-metadata">

**Author:** ![Seth\_Figgers](https://avatars.discourse-cdn.com/v4/letter/s/eb8c5e/32.png) [@Seth\_Figgers](https://forum.inductiveautomation.com/u/Seth_Figgers)\
**Post date:** [July 31, 2026, 2:05pm UTC](https://forum.inductiveautomation.com/t/hash-algorithm-for-storing-password-in-internal-db/54015/7 "2026-07-31T14:05:44Z")

</div>

For anyone using 8.3+, the method for encrypting embedded passwords in Ignition has changed to the [secrets management system](https://www.docs.inductiveautomation.com/docs/8.3/platform/security/secrets-management) which uses [JSON web encryption](https://datatracker.ietf.org/doc/html/rfc7516). You can use the [system.secrets functions](https://www.docs.inductiveautomation.com/docs/8.3/appendix/scripting-functions/system-secrets) to interact with it in scripts.

```python
encrypted = system.secrets.encrypt("super_secret_password")
# creates a dict that looks something like
# {
# 'ciphertext': u'b2gCHVqgoy6rd2vrURMrZXCDHKwK4uiYjIo',
# 'encrypted_key': u'hFFt56gIhgrK2gE3jyIUESAx_-_jgG7QulSkc3Yz62sw1RxJK896WA',
# 'iv': u'HMVA4hdEgbvJ7RkK',
# 'protected': u'eyJhbGciOiJBMjU2S1ciLCJlbmMiOiJBMjU2R0NNIiwiaWF0IjoxNzg1NTA2Mjc5LCJ6aXAiOiJERUYifQ',
# 'tag': u'22KEM3pF3eFN1L3fXuTegw'
# }

with system.secrets.decrypt(encrypted) as decrypted:
    print(decrypted.getAsString())
# super_secret_password
# => None

```