Hi Thanks to Cedric the passwords of users are now hashed with bcrypt, e.g. src/realms/from-scratch-realm-template/ac-identities/data/users/lenya.xml which should be much stronger than SHA-256 or MD-5. Thanks Michael