Parameter · Connections and Authentication / Authentication
md5_password_warnings
Enables deprecation warnings for MD5 passwords.
- Default:
on - Type: bool
- Applies: Session (any user)
In plain words
New in PostgreSQL 18. MD5 passwords are deprecated, so when a role gets an MD5-hashed password the server adds a warning explaining that. This switch turns that warning on (default) or off.
For DBAs and operators
When CREATE ROLE/ALTER ROLE stores an MD5 secret (because password_encryption = 'md5', or because the client sent an md5… hash), the server emits (verified on 18.6):
WARNING: setting an MD5-encrypted password
DETAIL: MD5 password support is deprecated and will be removed in a future release of PostgreSQL.
HINT: Refer to the PostgreSQL documentation for details about migrating to another password type.
The warning goes to the client and to the server log (it is WARNING level). Turning it off (it is user-context, so per session or per role is possible) is meant for scripted environments that cannot migrate yet and where the noise breaks tooling; it does not make MD5 any safer. The real fix is moving to SCRAM: set password_encryption = 'scram-sha-256', re-set passwords, then change pg_hba.conf methods to scram-sha-256.
How to change it
Any user can change it for their session with SET.