In Oracle Database, passwords are never stored as plain text. Instead, Oracle uses a one-way hashing process to convert your password into a fixed-length string of gibberish that can't be reversed.

When you log in, Oracle hashes the password you just typed and compares it to the hash stored in the system. If they match, you're in.

1. Where are they stored?

The hashes are stored in the data dictionary, specifically in a "base table" called SYS.USER$.

• PASSWORD column: Stores the old, legacy 10g hashes.

• SPARE4 column: Stores the modern, secure 11g and 12c hashes (this column is a "secret" hiding spot for the more complex data).

You can see which versions your users have by querying the public view:

SELECT username, password_versions FROM dba_users;

2. The Evolution of the Hash

Oracle has updated its hashing algorithms over the years to keep up with faster computers and more advanced hackers.

10G Version: The Legacy (Insecure)

• Algorithm: DES (Data Encryption Standard).

• Flaw: It converted everything to uppercase before hashing. This meant "Password123" and "PASSWORD123" were identical.

• Status: Deprecated. Modern Oracle databases (19c, 21c, 23c) run in "Exclusive Mode" by default, which blocks these old hashes entirely.

11G Version: The SHA-1 Era

• Algorithm: SHA-1 (Secure Hash Algorithm 1).

• Improvement: Introduced Case Sensitivity and Salting.

• What is Salt? A "salt" is a random string added to your password before hashing. Even if two users have the same password, their hashes will look different because their "salts" are different. This prevents "Rainbow Table" attacks.

  +1

12C Version: The Modern Standard

• Algorithm: SHA-512.

• Why it's better: It creates a much longer, 512-bit hash. It is significantly harder to "brute force" than older versions. This is the version you want all your users to have in 2026.

3. Password "Verifiers"

Oracle calls these stored hashes Verifiers. In the SPARE4 column, a 12c verifier looks like a long string starting with S: and T:.

• S: Represents the SHA-1 hash.

• T: Represents the SHA-512 hash.

4. Why "Hashing" and not "Encryption"?

People often use these terms interchangeably, but they are very different:

• Encryption is a two-way street. With a key, you can turn the gibberish back into the original password.

• Hashing is a one-way street. There is no "un-hash" button. This is safer because even if a hacker steals the database files, they can't simply "decrypt" the passwords to see them.

5. Security Best Practices for 2026

• Kill the 10G Hashes: Ensure your SQLNET.ORA has SQLNET.ALLOWED_LOGON_VERSION_SERVER=12. This forces the database to use only the most secure SHA-512 hashes.

• Password Profiles: Use Oracle Profiles to enforce complexity (e.g., must contain a symbol, a number, and be at least 12 characters).

• Rotate Passwords: Periodic changes ensure that even if a hash is being cracked in the background, it becomes useless once the user changes their password.

Summary

Oracle stores passwords as salted hashes in the SYS.USER$ table. Over time, these have evolved from simple DES hashes to highly secure SHA-512 verifiers.