Global user and password policies. These settings control how passwords are hashed and stored, and which characters are allowed in usernames. For managing individual user accounts, see User Management.

users:
  passwordHashAlgorithm: { type: argon2id }
  passwordHashAutoUpdate: true
  usernamePattern: '^[a-zA-Z0-9_\@\-\.]{1,128}$'

users.passwordHashAlgorithm

object | "SHA256" | "SHA384" | "SHA512" = { type: SHA512, saltLength: 20 }

# Since 2.19.0 (object form):
users:
  passwordHashAlgorithm: { type: argon2id }

# Before 2.19.0 (string form):
users:
  passwordHashAlgorithm: SHA512
  passwordSaltSize: 20

Algorithm used to hash stored passwords. Accepts either a string or an object (since v2.19.0). The object form supports both simple hash algorithms and Argon2.

When not specified, SHA512 with 20-byte salt is used.

users.passwordHashAlgorithm.type

string: "SHA256" | "SHA384" | "SHA512" | "argon2id" | "argon2i" | "argon2d" required

Hash algorithm. SHA-2 variants (SHA256, SHA384, SHA512) and Argon2 variants (argon2id, argon2i, argon2d) are supported. Argon2 is significantly more resistant to brute-force attacks and is recommended for new deployments, at the cost of higher memory and CPU usage per login.

users.passwordHashAlgorithm.saltLength

number = 20

Salt length in bytes. Allowed range is 8–256. When absent, users.passwordSaltSize is used as a fallback.

Argon2-specific parameters

users.passwordHashAlgorithm.p

number = 4

Number of memory lanes processed in parallel (parallelism factor).

users.passwordHashAlgorithm.t

number = 3

Number of iterations (time factor).

users.passwordHashAlgorithm.m

number = 65536

Memory cost in KiB. Minimal value is 8*p. Default is 65536 (64 MB).

users.passwordHashAlgorithm.tagLength

number = 32

Output hash length in bytes.

users.passwordHashAutoUpdate

boolean = true

Automatically re-hash the password on login when the stored hash uses an outdated algorithm or salt size.

users.passwordSaltSize

number = 20

Salt size in bytes used by simple hash algorithms. Allowed range is 8–256.

users.usernamePattern

string = "^[a-zA-Z0-9_\@\-\.]{1,128}$"

Regular expression that validates usernames. The default allows alphanumeric characters, underscores, hyphens, @, and dots, up to 128 characters.