The instructions in default.settings.php say

This variable will be set to a random value by the installer. All one-time login links will be invalidated if the value is changed. Note that if your site is deployed on a cluster of web servers, you must ensure that this variable has the same value on each server. If this variable is empty, a hash of the serialized database credentials will be used as a fallback salt.

but this explanation of salting says

A new random salt must be generated each time a user creates an account or changes their password.

and goes on to clarify that each salted hash (eg password) should have its unique salt stored along with the hashed+salted password in the database.

Am I misunderstanding the article I read on salting, or is Drupal using a faulty practice for the sake of convenience, or is the article wrong, or is there something else going on?

  • Good question...re-using the salt would be required as I understand it...otherwise the resulting password hash would never be the same for the same password...for one-time login this might not matter...I would think if Drupal stored password salt for each account individually then the end result would be more secure...a quick google seems to confirm my suspicion that the authentication layer is pluggable and would allow a custom module to do just that. If you find anything more concrete on this subject please share :) Commented Nov 23, 2014 at 4:22

1 Answer 1


I have migrated other CMS's to Drupal and had experience moving user accounts. Drupal's password algorithm is extremely good.

The salt you are referring to in the settings.php is not used for passwords. The drupal_hash_salt salt is used for generation of things like cookies. Hence why it says you must keep it the same across all web servers if you are in a load balanced setup.

Generation of passwords uses the SHA512 algorithm with randomly generated salts using openssl php libraries (not mt_rand or other weak random number generators).

If you want to learn more about password generation you can start here reading the API documentation for Drupal

You see that in the function to generate it calls a "private" function to generate a new password salt (_password_generate_salt()). Which in turn calls a lot of other private, custom Drupal functions (it is a long rabit hole).

So in general the password scheme used for Drupal is extremely deep and nested, it does not use PHP functions considered to be "weak".

  • 2
    This answer matches my understanding. Drupal 7 and up use a password hashing mechanism based on openwall.com/phpass and there is the phpass contrib backported to 6.x for anyone on 6.x
    – greggles
    Commented Nov 24, 2014 at 14:37
  • Ah, I was misunderstanding what the salt in the settings.php file was actually being used for. Thanks!
    – beth
    Commented Nov 24, 2014 at 19:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.