# Migration from Keycloak with argon2 passwords to Auth0

**URL:** <https://community.auth0.com/t/migration-from-keycloak-with-argon2-passwords-to-auth0/187891>\
**Category:** Get Help\
**Tags:** reset-password-prompt-new-experience, free-trial, login-experience\
**Created:** [June 12, 2025, 12:45pm UTC](https://community.auth0.com/t/migration-from-keycloak-with-argon2-passwords-to-auth0/187891 "2025-06-12T12:45:30Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Pedigree4163](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/pedigree4163/32/72659_2.png) [@Pedigree4163](https://community.auth0.com/u/Pedigree4163)\
**Post date:** [June 12, 2025, 12:45pm UTC](https://community.auth0.com/t/migration-from-keycloak-with-argon2-passwords-to-auth0/187891/1 "2025-06-12T12:45:30Z")

</div>

Hello,  
I am currently using Keycloak 26.2.3 with argon2 password encryption. The parameters are:

```auto
{
  "hash_iterations": 5,
  "algorithm": "argon2",
  "additionalParameters": {
    "hashLength": ["32"],
    "memory": ["7168"],
    "type": ["id"],
    "version": ["1.3"],
    "parallelism": ["1"]
  }
}

```

How can I specify the password in the import with custom\_password\_hash? All combinations do not work.

Working through all the existing documentation snippets, my approach would be to transform this example

```auto
{
  "value": "SOMEHASHWITHTRAILING=",
  "salt": "SOMESALTWITHTRAILING==",
  "additionalParameters": {}
}

```

to this custom\_password\_hash

```auto
"custom_password_hash": {
  "algorithm": "argon2",
  "hash": {
    "value": "$argon2id$v=19$m=7168,t=5,p=1$SOMESALTWITHOUTTRAILING$SOMEHASHWITHOUTTRAILING"
  }
}

```

I can import the users this way, but I always get the error:

```auto
"error": {
  "message": "Password change required.",
  "reason": "Verification failed for the provided custom_password_hash: {'algorithm':'argon2','hash':{'value':'$argon2id$v=19$m=7168,t=...'},'salt':{'value':''}}"
}

```

What am I doing wrong? Thanks for the help in advance

---

<div class="post-metadata">

**Author:** ![Pedigree4163](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/pedigree4163/32/72659_2.png) [@Pedigree4163](https://community.auth0.com/u/Pedigree4163)\
**Post date:** [June 12, 2025, 2:34pm UTC](https://community.auth0.com/t/migration-from-keycloak-with-argon2-passwords-to-auth0/187891/3 "2025-06-12T14:34:57Z")

</div>

By the way, I wrote this script to convert my export:

```python
import json

result = []

with open('keycloak-export.json', 'r') as file:
    data = json.load(file)

for user in data['users']:
    if 'service-account' in user['username']:
        continue # Skip service accounts for now

    pw_data = next((p for p in user['credentials'] if p['type'] == 'password'), None)
    if pw_data is None:
        raise ValueError(f"User {user['username']} does not have a password credential.")
    
    pw_sec = json.loads(pw_data['secretData'])
    pw_cred = json.loads(pw_data['credentialData'])

    if pw_cred['algorithm'] != 'argon2':
        raise ValueError(f"User {user['username']} does not have an argon2id password credential.")
    if pw_cred['additionalParameters']['version'] != ['1.3']:
        raise ValueError(f"User {user['username']} does not have an argon2id v1.3 password credential.")
    if pw_cred['additionalParameters']['type'] != ['id']:
        raise ValueError(f"User {user['username']} does not have an argon2id password credential of type 'id'.")
    
    pw_m = pw_cred['additionalParameters']['memory'][0]
    pw_t = pw_cred['hash_iterations'] # This should be in camelCase, but it's a bad word
    pw_p = pw_cred['additionalParameters']['parallelism'][0]
    pw_salt = str(pw_sec['salt']).rstrip('=')
    pw_hash = str(pw_sec['value']).rstrip('=')
    
    result.append({
        "username": user['username'],
        "email": user['email'],
        "email_verified": user['emailVerified'],
        "given_name": user['firstName'],
        "nickname": user['firstName'],
        "family_name": user['lastName'],
        "name": f"{user['firstName']} {user['lastName']}",
        "custom_password_hash": {
            "algorithm": "argon2",
            "hash": {
                "value": f"$argon2id$v=19$m={pw_m},t={pw_t},p={pw_p}${pw_salt}${pw_hash}"
            }
        }
    })

with open('auth0-import.json', 'w') as file:
    json.dump(result, file, indent=4)
print(f"Exported {len(result)} users to auth0-import.json")

```

---

<div class="post-metadata">

**Author:** ![vlad.murarasu](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/vlad.murarasu/32/72793_2.png) [@vlad.murarasu](https://community.auth0.com/u/vlad.murarasu)\
**Post date:** [June 13, 2025, 6:58pm UTC](https://community.auth0.com/t/migration-from-keycloak-with-argon2-passwords-to-auth0/187891/4 "2025-06-13T18:58:55Z")

</div>

Hi @Pedigree4163,

Welcome to the Auth0 Community!

Try adding the encoding to the hash section as shown here:

```auto
"custom_password_hash": {
    "algorithm": "argon2",
    "hash": {
        "value": f"$argon2id$v=19$m={pw_m},t={pw_t},p={pw_p}${pw_salt}${pw_hash}",
        "encoding": "utf8"
    }
}

```

Let us know if this fixes the issue.

Have a good one,  
Vlad

---

<div class="post-metadata">

**Author:** ![Pedigree4163](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/pedigree4163/32/72659_2.png) [@Pedigree4163](https://community.auth0.com/u/Pedigree4163)\
**Post date:** [June 13, 2025, 8:15pm UTC](https://community.auth0.com/t/migration-from-keycloak-with-argon2-passwords-to-auth0/187891/6 "2025-06-13T20:15:42Z")

</div>

Hi @vlad.murarasu,  
thanks for your help, unfortunately it doesn’t work either.  
I’m guessing it’s because of how Keycloak handles input? But Argon2 is actually a standard, isn’t it?  
Thank you

---

<div class="post-metadata">

**Author:** ![Pedigree4163](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/pedigree4163/32/72659_2.png) [@Pedigree4163](https://community.auth0.com/u/Pedigree4163)\
**Post date:** [June 27, 2025, 8:38am UTC](https://community.auth0.com/t/migration-from-keycloak-with-argon2-passwords-to-auth0/187891/7 "2025-06-27T08:38:13Z")

</div>

Does anyone else have any ideas?