Change the hash algorithm for password encryption

Abstract

How to change the weak SHA1 password encryption algorithm to the more secure SHA512 option for Sitecore.

Applies to

All core roles that require Sitecore client access (Content Management and EXM Dispatch).

Sitecore Installation Framework

Hash algorithm not changed by default.

Azure Toolkit

Hash algorithm not changed by default.

For user management, Sitecore uses the Microsoft ASP.NET membership provider by default.

When you create a new website, you must change the weak default hash algorithm (SHA1) that is used to encrypt user passwords to a stronger algorithm. The supported hash algorithms are listed in the Microsoft documentation for the CryptoConfig Class.

To change the hash algorithm:

  1. Log in as an administrator.

  2. Update the web.config file. In the <membership> node, set the hashAlgorithmType setting to the value that you want. We recommend that you use SHA512.

  3. Use the User Manager application to change the admin password, so that it is hashed with the new algorithm.

    Note

    After you have changed the hash algorithm, you are no longer able to type a new admin password when you want to change it. Instead, to get a new hashed admin password, click Generate.

  4. Update the passwords for other users to hash them with the new algorithm.

Important

The Microsoft ASP.NET membership provider does not provide a facility for upgrading to a different hash algorithm after you have created some user accounts. If you change the hash algorithm, existing users can no longer log into the system and must create new passwords.