Encryption of users passwords in the TYPO3 database

Question

What is the most secure option to store passwords for TYPO3 frontend and backend users ? Which encryption algorithm is used ?

Answer 1

There is no encryption of passwords. The passwords are hashed, the mandatory extension "saltedpasswords" takes care of that and provides multiple salted hash algorithms.

The default hashing algorithm configured for both frontend users and backend users is PBKDF2 for new instances, which is the NIST recommended way to store passwords in a FIPS compliant way.

Other hash algorithms can be configured, for instance blowfish and phpass are available by default, too. Own hash algorithms can be added and used if needed.