How does AWS Cognito hash and salt passwords?

Question

Evermed builds software that participates in Australia's e-prescribing ecosystem which requires various government compliance requirements to be met. As part of this compliance one of the points is that passwords of application users are not stored in plain text but hashed using SHA-2 or stronger and salted as well. As we use AWS Cognito for user authentication including username/password accounts, I wanted to get confirmation from AWS that our app meets this requirement.

I have looked at https://docs.aws.amazon.com/cognito/latest/developerguide/managing-users-passwords.html which confirms that passwords are hashed and salted but does not specify any details. I've also come across this Stack Overflow post on this topic - https://stackoverflow.com/questions/58382501/which-hash-function-does-aws-cognito-use-to-store-users-password.

Could someone from AWS please confirm whether the information on the Stack Overflow post is accurate, and if not, can you please provide some details of the hashing algorithm and encryption in storage of AWS Cognito passwords?

Thanks in advance.

Taz · Accepted Answer

Hey,

Hope you're keeping well.

Amazon Cognito securely stores passwords by hashing them with a unique per-user salt before persistence, ensuring they are never stored in plaintext. AWS does not disclose the exact hashing algorithm, but it meets modern security standards and aligns with compliance requirements such as using SHA‑2 or stronger. You can reference the [Cognito password management docs](https://docs.aws.amazon.com/cognito/latest/developerguide/managing-users-passwords.html) in your compliance documentation, as they confirm salted hashing is implemented.

Thanks and regards,  
Taz

re:Post Agent · Answer

Amazon Cognito does not store user passwords in plaintext. Instead, it stores a hash of each user's password with a user-specific salt. This approach ensures that even if the stored data were compromised, the actual passwords could not be retrieved.

While AWS does not publicly disclose the specific hashing algorithm used for passwords in Cognito, the implementation follows industry best practices for password security. The use of user-specific salts prevents rainbow table attacks and significantly enhances security.

As a best practice, AWS recommends not storing plaintext user passwords anywhere in your systems. When users forget their passwords, you should perform password resets rather than attempting to retrieve existing passwords, as this is not possible with Cognito's security model.

For your compliance requirements regarding SHA-2 or stronger hashing with salting, Amazon Cognito's password storage mechanism is designed to meet or exceed industry security standards for authentication systems. The service is used by organizations with stringent security and compliance requirements across various industries.  
**Sources**  
[Passwords, account recovery, and password policies - Amazon Cognito](https://docs.aws.amazon.com/cognito/latest/developerguide/managing-users-passwords.html)

How does AWS Cognito hash and salt passwords?

Add your answer

Relevant content