Could anyone describe what sort of encryption mechanism Salesforce uses when encrypting answers to security questions and also the passwords for user accounts? Is this AES256?

Any help will be appreciated. Also, if someone could provide any documentation on this, it will help.


Salesforce uses a number of security enhancements, some of which will only be released to people after signing an NDA. We do know that passwords are not stored in the database. Instead, a one-way hash is computed from the inputted password, which is then encrypted before being stored in the database. Session IDs are encrypted twice using an algorithm that will only be disclosed under NDA. Security answers are also presumably one-way hashed as well. There is no way to recover a password or security answer from the hashes. Session IDs are decrypted with each call to the server for validation.

  • Thanks sfdcfox. Appreciate your help! 1+ and marked it as the answer. – subodhbahl Nov 8 '13 at 19:01

Salesforce describes its ISO 270001 security level as follows, in respect to passwords encryption...

All passwords are stored in MD-5 hash format.

  • Thanks Andrew. Any word on the security question/answer encryption format? I appreciate your help. – subodhbahl Nov 8 '13 at 18:52
  • Sorry, yes should have mentioned, I didn't find anything specific on that, but my guess its the same. – Andrew Fawcett Nov 8 '13 at 19:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.