I need to get user accounts' password hashes and salts from a Drupal 7 app, so as to migrate these accounts into Stormpath. Could you please help me to figure out where this data is stored and how to get it from the DB?


The password hashes & salts are stored in the pass column in the users table with the first 4 bytes being settings, the next 8 bytes being the salt, and the remaining the password. See the user_hash_password() & _password_generate_salt() docs for how salts are generated.

| improve this answer | |
  • Thanks. Where are the salt byte arrays stored though? – Daniel Sep 30 '15 at 16:28
  • 1
    I think I found the answer in a comment on stackoverflow.com/a/9877006/805141 : "the salt is the 5th character through the 12th in the stored Drupal string." Presumably the string he's referring to is the hashed password. – Daniel Sep 30 '15 at 16:39
  • Could you please confirm that this is correct @Shawn Conn ? – Daniel Sep 30 '15 at 16:40
  • Correct. The first 4 bytes are settings, the next 8 (5-12) are the salt, the rest is the password hash. I've updated the answer to make that clearer. – Shawn Conn Sep 30 '15 at 16:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.