I have refactored an old Drupal 6 site to Drupal 8 and my only problem is, i migrated the users but the password is incorrect. i know that the password in Drupal 6 is a MD5 hash, but i cannot find a solution to convert this password, that Drupal 8 can read it.

Is there any solution for the password migration yet? can i give the MD5 hash a prefix inside of the database to make it readable?

3 Answers 3


User and user password migration is part of the Migrate and Migrate Drupal modules that come with Drupal 8 and that can easily be accessed using the Migration Drupal UI.

One word of warning though, from the guide on Upgrading using the migration user interface:

Due to password encryption, user accounts take particularly long to import.

  • 3
    The UI is actually just the UI, it's the migrations themself that deal with this. Basically, it is the same logic as the Drupal 7 upgrade path, the md5 hashes are hashed again using the new API, and when such a user tries to log in, we first hash the password with md5(), and then again, compare it, if it matches, we generate a new hash that doesn't rely on md5 and persist that.
    – Berdir
    Jan 27, 2017 at 16:35

Security wise it would make sense to import them in Drupal and then use the Mass Password Reset module to reset all passwords.


See Migrating MD5 hashed passwords

There is also a D6 migration example in /core/modules/user/migration_templates/d6_user.yml:

id: d6_user
label: User accounts
  - Drupal 6
  plugin: d6_user
  pass: pass
  plugin: entity:user
  md5_passwords: true

Key solution here to correctly migrate the passwords is to use the md5_passwords: true option for the destination user entity. So make sure you include that option in your user migration config.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.