I have a Joomla 3.10 and a Drupal 9 site.

I want to migrate user passwords from Joomla to Drupal. I have seen that Joomla uses bcrypt and Drupal uses sha512 as the password encryption.

Is it possible to migrate user passwords from Joomla to Drupal? If yes, how can I do this?

  • Welcome to Drupal Answers! Are you asking about code to write?
    – apaderno
    Commented Jul 25, 2022 at 15:31
  • (Also, password aren't encrypted. Drupal stores the password hash and verify the password entered by the user has the same hash. It works because two different passwords cannot have the same hash, except in the case of hash collision, which the hash algorithms try to avoid/limit.)
    – apaderno
    Commented Jul 25, 2022 at 15:34
  • Thank you Apaderno! I am looking for something to migrate Joomla passwords to Drupal so users can login immediately. If it isn't possible, I will tell users to reset their password when they login for the first time.
    – user106319
    Commented Jul 26, 2022 at 7:45

3 Answers 3


If the other site uses Phpass (Portable PHP password) password hashes, which are used from Drupal and from Joomla (starting with versions 2.5.18 and 3.2.1), then it's possible to migrate passwords. Drupal is able to handle Phpass password hashes that start with $P$, which are MD5 hashes normally used by phpBB3, that start with $H$, still MD5 hashes, that start with U$, which are Drupal 6 password hashes updated by user_update_7000(), and that start with $S$, the usual SHA512 password hashes Drupal 7 uses.

For other password hashes, a module should create a service that implements PasswordInterface and that verifies the password entered from the user matches the password hash stored in the database in PasswordInterface::check().
As reference, the default code used by Drupal core is in the PhpassHashedPassword class.

  • Thank you for your answer! In the database I have in the Joomla site, it starts with this: $2y$10$.
    – user106319
    Commented Jul 26, 2022 at 7:25
  • That is a bcrypt hash. Since JOOMLA is said to use Phpass password hashes, I would first check if JOOMLA allows to migrate from a bcrypt password hash to a Phpass password hash. If that is possible, though, it would be done when users log in. In that moment, once the users enter their password,the password would be verified, and then the password would be used to generate a Phpass password hash.
    – apaderno
    Commented Jul 26, 2022 at 7:47
  • I have searched online for some information about it and I found a page where I think they state that Phpass will not be used in Joomla: Use Portable PHP Passwords. I think the easiest way is to tell users to change their password when they login the first time.
    – user106319
    Commented Jul 26, 2022 at 8:00
  • The problem is that, if you do that on the Drupal side, you cannot know if the user who entered the username is the user who created the account. You cannot simply ask to the user who entered a username to enter a new password. You need also to verify that user knows the old password. If you just have a bcrypt hash, you cannot, from Drupal, except in the case a module can handle bcrypt hashes.
    – apaderno
    Commented Jul 26, 2022 at 8:39
  • Keep also in mind that, from a password hash, you cannot get the password. Hashes are one-way functions: You don't return back.
    – apaderno
    Commented Jul 26, 2022 at 8:40

No. If the password hash algorithms are different you cannot migrate the hash with Drupal Core alone without installing a module that changes the algorithm, if such module exists.


The answer depends on a lot of different factors.

Drupal uses not only sha512, but also a certain salt strategy, certain loop strategy, and data storage strategy in the password field in the database. Drupal core has a concept of supporting a few different password strategies and contributed modules can support others.

I did find this Password Bcrypt module for Drupal 7 which could be helpful to you.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.