I'm doing a user migration from Drupal 7 to Drupal 8 (the data is in json format)
Most of the fields have been imported to the new website. Now, I'm in the process to migrate the password; this field is, of course, encrypted/hashed (as far as I understood, Drupal uses SHA512 by default with a salt).

So far, I have found this answer and adapted my code like below:

$users_json = file_get_contents("../import/users.json");
$users_array = json_decode($users_json, true);

foreach($users_array as $user){

    $values = array(
        'name' => $user["name"],
        'pass' => [
            'value' => $user["pass"],
            'pre_hashed' => TRUE,
        'status' => $user["status"],
        'mail' => $user["mail"],
    $userStorage = \Drupal::entityTypeManager()->getStorage('user');
    $userEntity = $userStorage->create($values);
    $role = $user["roles"][0];


Now, my question is: Is it a good approach? How do I import this kind of field? Do I have to decrypt/de-hash the password?


1 Answer 1


You can follow document.

The $P$ is the so called hash type identifier which indicates that the hash is a portable Phpass hash. The string after that consists of salt and a hash. The portable Phpass hashes can be migrated to Drupal 8 as-is. When the user logs in to your Drupal 8 site for the first time, Drupal will re-hash the password. The salted hash used in this example is for a password 'test'.

If the source system was a PHP based application that used crypt() or password_hash(), these hashes should work as-is and they can be migrated 1:1 like in the Phpass example above. When the user logs in to your Drupal 8 site for the first time, Drupal will re-hash the password.

Here is my example convert old pass using md5


namespace Drupal\my_module;

use Drupal\Core\Password\PhpassHashedPassword;
use Drupal\Core\Password\PasswordInterface;

 * Provides custom password hash comparison for migrated passwords.
class MyModulePasswordService extends PhpassHashedPassword implements PasswordInterface {

  public function check ($password, $hash) {
    // Check old pass is md5
    if (preg_match('/^[a-f0-9]{32}$/', $hash)) {
      $pwd_sercet = "pwd_sercet";
      $pass_hash = md5($pwd_sercet . $password);
      return ($pass_hash == $hash);
    return parent::check($password, $hash);

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.