I am currently reviewing Drupal 8's security features and was wondering about how Drupal stores user passwords. I know Drupal uses salted hashes to store the password in the database, but does Drupal also store a user's previously used passwords so that they can't reuse them again? If it does, does that list have a hard limit to it (i.e. does it only store the last twenty used passwords before recycling the list)?

I am only interested in the out of the box experience with Drupal 8. I know there are modules that you can use to add extra functionality/security to user passwords but that isn't part of this question.


2 Answers 2


Out of the box, Drupal only stores the salted hash for the current password. No previous passwords are stored without the help of a contrib module such as Password Policy.


Take a look a the Guardr distribution it has all of the security modules already integrated and configured.

Even if you don't use it, they do a good job of pointing out the security modules available.

  • Thanks for the suggestion, I was unaware of this distribution.
    – user5013
    Dec 6, 2017 at 16:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.