Role password encryption

The passwords associated with roles are always stored in an encrypted form, even if the role is created without the ENCRYPTED PASSWORD property. PostgreSQL determines the algorithm to use in order to encrypt the password via the password_encryption option in the postgresql.conf configuration file. By default, the value of the option is set to md5, which means that the password is computed as MD5 hashes. The only other option available since PostgreSQL 10 is scram-sha-256, which will make the encryption much more robust.

You can quickly check the configuration from the operating system command line:

$ sudo -u postgres grep password_encryption $PGDATA/postgresql.conf
password_encryption = scram-sha-256    # md5 or scram-sha-256

Alternatively, you can inspect the pg_settings system catalog:

forumdb=# SELECT name, setting, enumvals 
         FROM pg_settings 
         WHERE name = 'password_encryption';
        name         |    setting    |      enumvals
--...