How to Change a Password in PostgreSQL

When should I change a PostgreSQL password?

Rotate passwords after onboarding, role changes, suspected breaches, or policy-driven intervals. Short expiry cycles reduce risk.

Which methods exist?

Use SQL ALTER USER/ROLE inside any client, or run \password in the psql shell for interactive input.

What privileges are required?

Only a superuser or the role itself may change its password.Regular users cannot alter other accounts.

How do I change my own password?

psql -U alice -d ecommerce
\password


psql prompts for the new secret and stores it hashed (SCRAM-SHA-256 by default).

How do I change another role’s password?

ALTER USER app_user WITH PASSWORD 'Sup3rSecure!';


Run as postgres or another superuser. This immediately invalidates existing sessions unless password_encryption changes.

How do I enforce encryption?

Set password_encryption = 'scram-sha-256' in postgresql.conf before issuing ALTER USER.PostgreSQL then stores SCRAM hashes.

Can I script password rotation?

Yes. Combine psql -c "ALTER USER ..." with shell secret managers or CI pipelines.Always quote the password string.

Example in a deployment script

export NEW_PW=$(aws secretsmanager get-secret-value ...)
psql -d postgres -U postgres -c "ALTER USER app_user WITH PASSWORD '$NEW_PW';"


Best practices

Store secrets in a vault, rotate regularly, enforce least privilege, audit pg_authid, and use SCRAM over MD5.

What happens to existing connections?

Active sessions keep working until they reconnect.Plan rotations during low-traffic windows.

How do I verify the change?

Reconnect with the new credentials, or query SELECT rolname, rolpassword FROM pg_authid; as a superuser (hashed only).

Is rolling back possible?

No built-in rollback exists. Keep the previous secret in your vault until new connections succeed.

Related commands

ALTER ROLE is an alias for ALTER USER; CREATE USER sets an initial password; DROP USER removes the role.

.