I have existing customer data, which includes email addresses and passwords (already MD5 hashed.)

Can I import this data into Magento, whilst keeping the customers' existing passwords?

Will an override of Magento's customer authentication class be required?

  • Voting to reopen because it's a common requirement and there is a good, concise and accepted answer. Sep 18 '15 at 8:10
  • @fschmengler What is wrong with my answer?
    – Kane Shaw
    Mar 3 '16 at 23:59
  • Nothing, I said it is good Mar 4 '16 at 6:46


You do not need to modify Magento's authentication classes. You can import passwords already MD5 encrypted. I have tested this.

How Magento 1 CE stores passwords:

  • Password chosen by user: Foobar!
  • Salt random generated by Magento: 2sM0lWnxa
  • Password before MD5 encyption: 2sM0lWnxaFoobar! (that is <salt><password>)
  • Password in MD5 encryption: b55bd20f0ef25e759dc77b09fe7e4dfd
  • Password stored in database: b55bd20f0ef25e759dc77b09fe7e4dfd:2sM0lWnxa (that is <md5 password>:<salt>)

How to format already MD5 encrypted password for import (without salt):

  • Simply add a : (colon) to the end of the already MD5 encrypted password

How does this work?

We can see that Magento looks for a : (colon) in the string, and assumes what comes after it is the salt. If you place a : (colon) at the end of your already encrypted password and then nothing further, Magento will realise that there IS no salt for that password.

Getting the password into Magento

Alright, so now we know what we need to do to our passwords, how do we get them into Magento? Normally Magento will automatically encrypt a password you give it, but in our case we DON'T want it to because it's already done.

Turns out, this is simple too! When creating, or updating an existing customer by code you normally use this to set their password:

$customerModel = Mage::getModel("customer/customer");
// ... further code here to create customer (or update existing customer) ...
$customerModel->setPassword("Plain Text Password");

Instead of using the setPassword method on Customer Model, use setPasswordHash:

$customerModel->setPasswordHash("<md5 encrypted password>:");

For those who are facing the same problem with Magento 2, the @Kane Shaw answer is perfectly working if you import MD5 passwords and append them with ::0

  • Existing MD5 Password: a230b06a0387f5c697f08d83517cbb5d
  • Append ::0 to end (example: a230b06a0387f5c697f08d83517cbb5d::0)

Now Magento 2 knows that the password is MD5 encypted with no salt

  • 1
    Nice find! Thanks for that :) So, just to be sure: instead of simply adding : to the end of the password, you need to add ::0 for it to work in Magento 2?
    – Kane Shaw
    Jun 10 '20 at 4:08
  • If you can clarify that for me I will update the answer to include the Magento 2 method also and credit you.
    – Kane Shaw
    Jun 10 '20 at 4:29
  • @KaneShaw exactly! You only need to add ::0to bypass salt and to let Magento know you are using MD5 encryption. Another thing I discovered is that you need to have all alphabetic characters on lowercase otherwise numeric or alphanumeric passwords will not work Jun 10 '20 at 8:06
  • How are you importing customers? Are you using the Import CSV function from admin area? Is there a way to do the same using REST API? Aug 4 '20 at 0:19

Magento CE uses a salted MD5 hash.

You would need to over-ride Mage_Customer_Model_Session::login() or Mage_Customer_Model_Customer::validatePassword to adapt for the different passwords.

That said, changing password authentication methods is a bad idea. Consider just having your customers reset their passwords instead.

Also, the fact that Magento uses MD5 in CE and SHA2 in EE is a joke. MD5 is bad and insecure. I guess only EE customers at $15K+ per license get proper security.

Magento is way out of line here.

  • If anyone is reading this, please note that you do NOT need to override any core functions if the passwords you are importing are already MD5 encrypted. Please see my answer: magento.stackexchange.com/a/61854/21408
    – Kane Shaw
    May 1 '20 at 7:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.