# Password mismatching after upgrade **URL:** \ **Category:** Getting advice\ **Tags:** authentication, oidc\ **Created:** [February 18, 2026, 6:24am UTC](https://forum.keycloak.org/t/password-mismatching-after-upgrade/31279 "2026-02-18T06:24:50Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![akhrulloi](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/akhrulloi/32/12474_2.png) [@akhrulloi](https://forum.keycloak.org/u/akhrulloi)\ **Post date:** [February 18, 2026, 6:24am UTC](https://forum.keycloak.org/t/password-mismatching-after-upgrade/31279/1 "2026-02-18T06:24:50Z")
I’m facing an issue after upgrading Keycloak from version 18 to 26. After the upgrade, users are unable to log in and receive “Invalid user credentials”. Here is what I observed: • Existing users in the database have passwords hashed with PBKDF2-SHA256. • After upgrading to Keycloak 26, newly reset passwords are stored using Argon2. • When I reset a user’s password, login works correctly. • However, migrated users with PBKDF2 hashes cannot log in. It seems like during authentication Keycloak is trying to verify the old PBKDF2 hashes using Argon2 instead of the original algorithm. I cannot reset passwords for all users because there are many of them. My questions: 1. Should Keycloak 26 automatically support verifying existing PBKDF2 hashes after upgrade? 2. Do I need to explicitly enable PBKDF2 as a password policy in the new version? 3. Is there any recommended migration strategy for password hash algorithms when upgrading to Argon2? I would really appreciate any guidance on how to properly handle this migration without forcing all users to reset their passwords. ---
**Author:** ![melancholia](https://avatars.discourse-cdn.com/v4/letter/m/dbc845/32.png) [@melancholia](https://forum.keycloak.org/u/melancholia)\ **Post date:** [February 20, 2026, 11:20pm UTC](https://forum.keycloak.org/t/password-mismatching-after-upgrade/31279/3 "2026-02-20T23:20:39Z")
yes – I believe so w.r.t password policy - [https://docs.redhat.com/en/documentation/red\_hat\_build\_of\_keycloak/26.0/html/server\_administration\_guide/configuring-authentication\_server\_administration\_guide#password-policies](https://docs.redhat.com/en/documentation/red_hat_build_of_keycloak/26.0/html/server_administration_guide/configuring-authentication_server_administration_guide#password-policies) ---
**Author:** ![dasniko](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/dasniko/32/2969_2.png) [@dasniko](https://forum.keycloak.org/u/dasniko)\ **Post date:** [February 21, 2026, 8:43pm UTC](https://forum.keycloak.org/t/password-mismatching-after-upgrade/31279/4 "2026-02-21T20:43:32Z")
> [@akhrulloi](#): > > Should Keycloak 26 automatically support verifying existing PBKDF2 hashes after upgrade? Yes. It should and it does, if the migrated data is correct. > [@akhrulloi](#): > > Do I need to explicitly enable PBKDF2 as a password policy in the new version? No, setting a hash algorithm in the password policy is only for creating the hash of a _new/changed_ password, not responsible to compare existing passwords. > [@akhrulloi](#): > > Is there any recommended migration strategy for password hash algorithms when upgrading to Argon2? No, just export the users with their credential data properly (`secretData`AND `credentialData`) from your old system and import the data to your new system. Worked in all of the environments I migrated for various customers. ---
**Author:** ![system](https://global.discourse-cdn.com/free1/uploads/keycloak/original/1X/eb342909d95cf32cbb7517610022c6a0046a9ffb.png) [@system](https://forum.keycloak.org/u/system)\ **Post date:** [August 20, 2026, 8:44pm UTC](https://forum.keycloak.org/t/password-mismatching-after-upgrade/31279/5 "2026-08-20T20:44:19Z")
Closed on August 20, 2026, 8:44pm UTC This topic was automatically closed 180 days after the last reply. New replies are no longer allowed.