Change the hash algorithm for password encryption

Current version: 9.0

Applies to

All core roles that require Sitecore client access (Content Management and EXM Dispatch).

Sitecore Installation Framework

Hash algorithm not changed by default.

Azure Toolkit

Hash algorithm not changed by default.

For user management, Sitecore uses the Microsoft ASP.NET membership provider by default.

When you create a new website, you must change the weak default hash algorithm (SHA1) that is used to encrypt user passwords to a stronger algorithm. The supported hash algorithms are listed in the Microsoft documentation for the CryptoConfig Class.

To change the hash algorithm:

  1. Log in as an administrator.

  2. Update the web.config file. In the <membership> node, set the hashAlgorithmType setting to the value that you want. We recommend that you use SHA512.

  3. Use the User Manager application to change the admin password, so that it is hashed with the new algorithm.


    After you have changed the hash algorithm, you are no longer able to type a new admin password when you want to change it. Instead, to get a new hashed admin password, click Generate.

  4. Update the passwords for other users to hash them with the new algorithm.


The Microsoft ASP.NET membership provider does not provide a facility for upgrading to a different hash algorithm after you have created some user accounts. If you change the hash algorithm, existing users can no longer log into the system and must create new passwords.

Do you have some feedback for us?

If you have suggestions for improving this article,