For those using the "password" or "md5" authentication method, this would be a good time to start using SCRAM instead.

First, set

    password_encryption = scram-sha-256

in postgresql.conf[1].

If setting up a new server, use auth method "scram-sha-256" in pg_hba.conf[2][3].

If upgrading an existing server, use auth method "md5" in pg_hba.conf, which actually allows either MD5 or SCRAM. Then, start updating the users' passwords to be encrypted with SCRAM by resetting the password (the "password_encryption" setting causes the new password to be encrypted with SCRAM). After there are no more md5 passwords in the system, you can set the pg_hba.conf auth method to "scram-sha-256" and you're done.

Note that this all requires connecting clients to support scram (version 10 or later of libpq).

[1] https://www.postgresql.org/docs/12/runtime-config-connection... [2] https://www.postgresql.org/docs/12/auth-pg-hba-conf.html [3] https://www.postgresql.org/docs/12/auth-password.html