Jon Bucud
10/24/2025, 3:16 PMJon Bucud
10/24/2025, 6:14 PM{
"email": "<mailto:jonbucud@mydomain.com|jonbucud@mydomain.com>",
"email_verified": true,
"blocked": false,
"custom_password_hash": {
"algorithm": "md5",
"hash": {
"value": "HASHgoesHERE",
"encoding": "base64"
},
"password": {
"encoding": "utf8"
}
}
}
I was originally doing this...
{
"email": "<mailto:jonbucud@mydomain.com|jonbucud@mydomain.com>",
"email_verified": true,
"blocked": false,
"user_metadata": {
"requires_password_change": false
},
"custom_password_hash": {
"algorithm": "md5",
"hash": {
"value": "HASHgoesHERE",
"encoding": "utf8"
}
}
}
I figured custom_password_hash replaced the whole password bit, so I was leaving that out.
Turns out it only defines how the hash itself is stored, you still have to tell Auth0 how to read the original password before it gets hashed.
Adding "password": { "encoding": "utf8" } basically says “hey Auth0, when you check this hash, the password started as UTF-8 text.”