# Internal Authentication Password Encoding

**URL:** <https://forum.inductiveautomation.com/t/internal-authentication-password-encoding/104959>\
**Category:** Ignition\
**Tags:** perspective\
**Created:** [April 10, 2025, 4:53pm UTC](https://forum.inductiveautomation.com/t/internal-authentication-password-encoding/104959 "2025-04-10T16:53:23Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![dillon](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/dillon/32/81537_2.png) [@dillon](https://forum.inductiveautomation.com/u/dillon)\
**Post date:** [April 10, 2025, 4:53pm UTC](https://forum.inductiveautomation.com/t/internal-authentication-password-encoding/104959/1 "2025-04-10T16:53:23Z")

</div>

I am looking into transferring our internal user source to an external database one to allow for easier maintainability from outside the Gateway's GUI. I would love to keep the same encoding rules Ignition leverages in their builtin user source so we would not require password changes. **Does anyone have information regarding the seeds/encoding strategy that is used?** I found this topic and doing some tests it doesn't seem to be true.

> [@Is it possible to access user source in gateway from Perspective view? If so, how?](https://forum.inductiveautomation.com/t/is-it-possible-to-access-user-source-in-gateway-from-perspective-view-if-so-how/89339/2):
>
> For your information, ignition will hash and encode in base64 all passwords.  
> So to store passwords, or check if the password are equals, use the function below
> 
> ```python
> import hashlib
> import base64
> 
> passwordHash = base64.b64encode(hashlib.sha1("Sup3rS3cr3tPa$word").digest())
> 
> ```
> 
> I hope this helps you.

---

<div class="post-metadata">

**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\
**Post date:** [April 10, 2025, 4:58pm UTC](https://forum.inductiveautomation.com/t/internal-authentication-password-encoding/104959/2 "2025-04-10T16:58:22Z")

</div>

Have you looked at the internal DB table that holds these passwords yet?

Are they in a format that looks something like `[01234567]abcdefg`?

---

<div class="post-metadata">

**Author:** ![dillon](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/dillon/32/81537_2.png) [@dillon](https://forum.inductiveautomation.com/u/dillon)\
**Post date:** [April 10, 2025, 4:59pm UTC](https://forum.inductiveautomation.com/t/internal-authentication-password-encoding/104959/3 "2025-04-10T16:59:54Z")

</div>

Yes, I started by looking in the idb via Kindling. That is the format.  
 ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/a/f/af941f41f6845d60b76d87dd6a17690e83c37cfd.png)

---

<div class="post-metadata">

**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\
**Post date:** [April 10, 2025, 5:00pm UTC](https://forum.inductiveautomation.com/t/internal-authentication-password-encoding/104959/4 "2025-04-10T17:00:48Z")

</div>

Ok, done by a function equivalent to this:

```java
    public static String sha256PasswordSalt(String password) {
        Random rand = new Random();
        String salt = String.format("%08X", rand.nextInt());
        String hashedPass = SecurityUtils.sha256(password + salt);
        return String.format("[%s]%s", salt, hashedPass);
    }

```

edit: hang on, gotta see if the sha256 function does anything unexpected...  
edit2: nope, just does sha256 on the input and returns the hex-formatted string you see in the table.

---

<div class="post-metadata">

**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\
**Post date:** [April 10, 2025, 5:07pm UTC](https://forum.inductiveautomation.com/t/internal-authentication-password-encoding/104959/5 "2025-04-10T17:07:06Z")

</div>

The other DB sources don't have the same expectations, though, so I'm not sure how smooth a transition this will be...

---

<div class="post-metadata">

**Author:** ![dillon](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/dillon/32/81537_2.png) [@dillon](https://forum.inductiveautomation.com/u/dillon)\
**Post date:** [April 10, 2025, 6:05pm UTC](https://forum.inductiveautomation.com/t/internal-authentication-password-encoding/104959/6 "2025-04-10T18:05:01Z")

</div>

Thanks Kevin. Definitely enough for me to be dangerous now 😅

---

<div class="post-metadata">

**Author:** ![dillon](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/dillon/32/81537_2.png) [@dillon](https://forum.inductiveautomation.com/u/dillon)\
**Post date:** [April 10, 2025, 6:34pm UTC](https://forum.inductiveautomation.com/t/internal-authentication-password-encoding/104959/7 "2025-04-10T18:34:29Z")

</div>

Working Python function for others that achieves the same thing

```python
import random
import hashlib

def sha256PasswordSalt(password):
    rand = random.Random()
    salt = "{:08X}".format(rand.randint(0, 0xFFFFFFFF))
    hashedPass = hashlib.sha256((password + salt).encode('utf-8')).hexdigest()
    return "[{}]{}".format(salt, hashedPass)

```