docs(security): clarify password and authentication token storage

[joshtrichards]

☑️ Resolves

N/A - prompted by a question about the ambiguity of the existing documentation on the forum along with my recurring own need to refer to the code and/or notes in this area.

Summary

Clarifies the password and authentication-token storage guidance in the server hardening documentation.

The existing text can be interpreted as saying that Nextcloud stores account passwords using reversible encryption instead of standard password hashing. In practice, these are separate mechanisms:

• The built-in database user backend stores a salted, one-way account-password hash, preferring Argon2id when supported by PHP and falling back to Argon2i or bcrypt.
• Authentication tokens are represented in the database by a hash derived from the token and the instance-specific secret.
• When auth.storeCryptedPassword is enabled and the login password is available, a separate, reversibly encrypted copy may be stored in the server-side record associated with an authentication token.

This change distinguishes those representations and explains why a recoverable copy may exist, how it is protected, and the security consequences of a combined token, configuration, and database compromise.

It also clarifies that:

• The authentication token itself does not contain the login password.
• Passwordless and some SSO-generated token records may not contain a recoverable password.
• Administrators can disable recoverable password storage with auth.storeCryptedPassword, subject to the documented functional consequences.
• External user backends control their own account-password storage and verification.

Follow-ups/related:

• Password length section may need updating; I'll try to address that in a separate PR (probably when I get around to correcting my forgotten pending fix(auth): Correct max password length in config.sample.php server#54091 for the auth.storeCryptedPassword config parameter)

TODO

• Backport to v34 (and possibly v35, depending on merge timing)
• Determine whether safe to backport to v33 based on implementation details (I think so but have not verified)

🖼️ Screenshots

✅ Checklist

• I have built the documentation locally and reviewed the output
• Screenshots are included for visual changes
• I have not moved or renamed pages (or added a redirect if I did)
• I have run codespell or similar and addressed any spelling issues

[github-actions]

📖 Documentation Preview

🔍 Open preview →

📄 1 changed documentation page

• admin_manual/installation/harden_server.rst

Last updated: Sat, 22 Aug 2026 17:26:13 GMT

[tflidd]

I would put this part first for clarification. I was first thinking about the Nextcloud user password, why it needs to be store, if this is for the server-side encryption etc.

[artonge]

might also no longer automatically

There are a lot of incertitude in this PR. This is one example. It would be better to fact check them to be able to provide a more solid documentation. But I know it takes time 🙈