# Password Hashing Algorithms

When storing credentials such as passwords and client secrets in local/database storage, Smile CDR uses a configurable secure hashing algorithm. Each password is individually salted and then hashed in order to defend against brute force cracking attempts, should an attacker gain access to the database.

Because the algorithm used is stored along with the hash, the hashing algorithm may be modified over time without invalidating existing passwords. In other words, if the hashing algorithm is changed, any passwords that are set in the future will use the new algorithm, but any passwords created in the past will continue to use the previous hashing algorithm.

Algorithms can be set for the following properties:

- Local Inbound Security module: [password\_encoding\_type](/content/docs/configuration_categories/credentials.html#property-password-encoding-scheme/index.html)
- SMART Outbound Security module: [client\_secret.encoding](/content/docs/configuration_categories/openid_connect_oic.html#property-client-secret-encoding/index.html)

# Available Algorithms

The following table shows the currently available hashing algorithms. The speeds show the average time taken to hash a single password on a server with average hardware (a 2.7 GHz Intel Core i7 was used for these values).

Care should be taken when selecting an appropriate level of security. If it takes 1000ms to hash a single password, this means that brute-force cracking of the password is exceedingly difficult but it also means that each user login will take a full second of processing time before it can proceed.

| Name | Description | Speed |
| --- | --- | --- |
| SHA256\_1000\_ROUND | [SHA2](https://en.wikipedia.org/wiki/SHA-2)-256 with 1,000 rounds | 4ms/password over 10 passes |
| SHA256\_10000\_ROUND | [SHA2](https://en.wikipedia.org/wiki/SHA-2)-256 with 100,000 rounds<br>_**Note:** this algorithm originally stated incorrectly that it uses 10,000 rounds._ | 44ms/password over 10 passes |
| SHA256\_100000\_ROUND | [SHA2](https://en.wikipedia.org/wiki/SHA-2)-256 with 1,000,000 rounds<br>_**Note:** this algorithm originally stated incorrectly that it uses 100,000 rounds._ | 223ms/password over 10 passes |
| PBKDF2\_256\_1000\_RND | [PBKDF2](https://en.wikipedia.org/wiki/PBKDF2)-256 with 1,000 rounds | 14ms/password over 10 passes |
| PBKDF2\_256\_10000\_RND | [PBKDF2](https://en.wikipedia.org/wiki/PBKDF2)-256 with 10,000 rounds | 34ms/password over 10 passes |
| PBKDF2\_256\_100000\_RND | [PBKDF2](https://en.wikipedia.org/wiki/PBKDF2)-256 with 100,000 rounds | 189ms/password over 10 passes |
| PBKDF2\_256\_310000\_RND | [PBKDF2](https://en.wikipedia.org/wiki/PBKDF2)-256 with 310,000 rounds using HMAC-SHA256. This is the recommended algorithm for new deployments using PBKDF2. | 229ms/password over 10 passes |
| BCRYPT\_10\_ROUND | [BCrypt](https://en.wikipedia.org/wiki/Bcrypt) with 10 rounds | 73ms/password over 10 passes |
| BCRYPT\_12\_ROUND | [BCrypt](https://en.wikipedia.org/wiki/Bcrypt) with 12 rounds | 238ms/password over 10 passes |
| BCRYPT\_14\_ROUND | [BCrypt](https://en.wikipedia.org/wiki/Bcrypt) with 14 rounds | 925ms/password over 10 passes |
| BCRYPT\_16\_ROUND | [BCrypt](https://en.wikipedia.org/wiki/Bcrypt) with 16 rounds | 3796ms/password over 10 passes |

[Two Factor Authentication](/content/docs/security/two_factor_auth.html)

Password Hashing Algorithms

Security

[Authentication Protocols](/content/docs/security/authentication_protocols.html)
[Authorization and Consent](/content/docs/security/authorization_and_consent.html)
[Inbound Security Module](/content/docs/security/inbound_security_module.html)
[Local Inbound Security Module](/content/docs/security/local_inbound_security_module.html)
[LDAP Inbound Security Module](/content/docs/security/ldap_inbound_security_module.html)
[Scripted Inbound Security Module](/content/docs/security/script_inbound_security_module.html)
[SAML Inbound Security Module](/content/docs/security/saml_inbound_security_module.html)
[Trusted Client Mode](/content/docs/security/trusted_client_mode.html)
[Roles and Permissions](/content/docs/security/roles_and_permissions.html)
[Callback Scripts](/content/docs/security/callback_scripts.html)
[Anonymous Access](/content/docs/security/anonymous_access.html)
[Consent Service](/content/docs/security/consent_service.html)
[Consent Service: JavaScript API](/content/docs/security/consent_service_javascript.html)
[Consent Service: Java API](/content/docs/security/consent_service_java.html)
[Security Recipes](/content/docs/security/security_recipes.html)
[Two Factor Authentication](/content/docs/security/two_factor_auth.html)
[Password Hashing Algorithms](/content/docs/security/password_hashing_algorithms.html)
[JWT Signature Algorithms](/content/docs/security/jwt_signature_algorithms.html)
[Troubleshooting Security](/content/docs/security/troubleshooting_security.html)

[JWT Signature Algorithms](/content/docs/security/jwt_signature_algorithms.html)