crecheck v6.0 has been released

Antananrivo, Madagascar - October 14, 2026

PostgreSQL credcheck extension

The credcheck PostgreSQL extension provides few general credential checks, which will be evaluated during the user creation, during the password change and user renaming. By using this extension, we can define a set of rules:

• allow a specific set of credentials
• reject a certain type of credentials
• deny password that can be easily cracked
• enforce use of an expiration date with a minimum of day for a password
• define a password reuse policy
• define the number of authentication failure allowed before a user is banned
• define a delay on authentication failures
• force users to change their password after first login
• throw a warning N days before when the password user is about to expire
• prohibit password changes
• last login and boot/shutdown information
• use of authentication failure with PgBouncer

Release 6.0 has been published,

This major release adds some new features and fix issues reported by users since last release.

• Allow integration of the max_auth_failure feature with pgbouncer. See documentation.
• Allow use of password_change_first_login with pgBouncer.
• Add credcheck.password_valid_min setting to force a short VALID UNTIL window on newly created roles. Useful to force new users to change their password quickly when the client (DBeaver, pgAdmin, ...) does not support the error reported when credcheck.password_change_first_login is enabled.
• Add an optional last-login history modelled on the Unix last(1)/wtmp. Records user sessions (name, login time, duration, backend pid, source IP and port, and optionally the last SQL query) plus PostgreSQL boot/shutdown/crash markers.
• Change the behavior of the credcheck.no_password_logging to not hide the error statement anymore but instead to replace every PASSWORD '<literal>' clause with dots inplace of the literal to not expose the password in the log.
• Add function pg_check_password( IN username name, IN password text ) to check a candidate password (and the associated username) against the credcheck username/password policy without creating or altering a role.
• Fix privilege escalation via self ALTER ROLE when password_valid_until is set.
• Fix memory leaks and a heap overflow.

Upgrade require a PostgreSQL restart to reload the credcheck library.

Complete list of changes and acknowledgements are available here

Links & Credits

credcheck is an open project under the PostgreSQL license maintained by HexaCluster. Any contribution to build a better tool is welcome. You can send your ideas, features requests or patches using the GitHub tools.

Links :

• Download: https://github.com/HexaCluster/credcheck/releases/
• Support: use GitHub report tool at https://github.com/HexaCluster/credcheck/issues

About credcheck

The credcheck extension is developed and maintained by Gilles Darold at https://hexacluster.ai. If you need more information please https://hexacluster.ai/contact-us/.

Documentation at https://github.com/HexaCluster/credcheck#readme