In using Firebase Authentication, are the passwords already encrypted?

Question

In using Firebase Authentication for let's say a website where you can register/login, are the passwords already encrypted? The account of the user will be saved in the Firestore but it will only show the name and email of the user, the passwords are not shown in the firestore.

score 2 · Answer 1 · answered Apr 23 '21 at 14:03

2

Yes the passwords are encripted by Firebase and you can't view them.

answered Apr 23 '21 at 14:03

Tarik Huber

7,061
2
12
18

Firebase uses [Scrypt](https://firebase.google.com/docs/reference/admin/java/reference/com/google/firebase/auth/hash/Scrypt) for encryption – Dharmaraj Apr 23 '21 at 14:16

score 2 · Accepted Answer · answered Apr 23 '21 at 14:07

Firebase Authentication uses an internally modified version of scrypt to hash account passwords. Even when an account is uploaded with a password using a different algorithm, Firebase Auth will rehash the password the first time that the account successfully logs in.

Accounts downloaded from Firebase Authentication will only ever contain a password hash if one for this version of scrypt is available, or contain an empty password hash otherwise.

Here is the Scrypt uses by firebase to hash password

In using Firebase Authentication, are the passwords already encrypted?

2 Answers2