chkpass

Overview

Version

Build

You can build the RPM / DEB packages for chkpass using pig build:

pig build pkg chkpass         # build RPM / DEB packages

Install

You can install chkpass directly. First, make sure the PGDG and PIGSTY repositories are added and enabled:

pig repo add pgsql -u          # Add repo and update cache

Install the extension using pig or apt/yum/dnf:

pig install chkpass;          # Install for current active PG version

pig ext install -y chkpass -v 18  # PG 18
pig ext install -y chkpass -v 17  # PG 17
pig ext install -y chkpass -v 16  # PG 16
pig ext install -y chkpass -v 15  # PG 15
pig ext install -y chkpass -v 14  # PG 14

dnf install -y chkpass_18       # PG 18
dnf install -y chkpass_17       # PG 17
dnf install -y chkpass_16       # PG 16
dnf install -y chkpass_15       # PG 15
dnf install -y chkpass_14       # PG 14

apt install -y postgresql-18-chkpass   # PG 18
apt install -y postgresql-17-chkpass   # PG 17
apt install -y postgresql-16-chkpass   # PG 16
apt install -y postgresql-15-chkpass   # PG 15
apt install -y postgresql-14-chkpass   # PG 14

Create Extension:

CREATE EXTENSION chkpass;

Usage

chkpass: auto-encrypted password data type

The chkpass extension provides a data type for storing encrypted passwords. Originally bundled with PostgreSQL (removed in PG 11), this is a standalone version for modern PostgreSQL.

CREATE EXTENSION chkpass;

Data Type

The chkpass type automatically encrypts passwords using Unix crypt() on input and stores only the encrypted form.

CREATE TABLE accounts (
    username text PRIMARY KEY,
    password chkpass
);

INSERT INTO accounts VALUES ('admin', 'mysecretpassword');

Operators

The = operator checks a plaintext password against the stored encrypted value:

SELECT * FROM accounts WHERE password = 'mysecretpassword';
-- Returns the matching row if the password is correct

Behavior

• Passwords are automatically encrypted on input – the plaintext is never stored
• Output displays the encrypted hash, not the original password
• Comparison with = encrypts the right-hand operand and compares hashes
• Uses the standard Unix crypt() function for encryption