# Moving users out of a Base44 app: can they keep their passwords?

**URL:** <https://community.auth0.com/t/moving-users-out-of-a-base44-app-can-they-keep-their-passwords/205287>\
**Category:** Get Help\
**Tags:** automatic-migration, user-migration, user-management, custom-database\
**Created:** [November 11, 2026, 2:14pm UTC](https://community.auth0.com/t/moving-users-out-of-a-base44-app-can-they-keep-their-passwords/205287 "2026-11-11T14:14:55Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![n001spartan](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/n001spartan/32/81689_2.png) [@n001spartan](https://community.auth0.com/u/n001spartan)\
**Post date:** [November 11, 2026, 2:14pm UTC](https://community.auth0.com/t/moving-users-out-of-a-base44-app-can-they-keep-their-passwords/205287/1 "2026-11-11T14:14:55Z")

</div>

We’re moving an app off Base44 onto our own stack and the part I’m stuck on is the users. As far as I can tell Base44 doesn’t let you export password hashes, so a normal user export would force everyone to reset their password.

Is there a way to bring them over with their existing passwords, ideally ending up in Auth0 or our own backend?

---

<div class="post-metadata">

**Author:** ![nik.baleca](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/nik.baleca/32/68749_2.png) [@nik.baleca](https://community.auth0.com/u/nik.baleca)\
**Post date:** [November 11, 2026, 2:28pm UTC](https://community.auth0.com/t/moving-users-out-of-a-base44-app-can-they-keep-their-passwords/205287/3 "2026-11-11T14:28:32Z")

</div>

Hi @n001spartan

Welcome to the Auth0 Community!

You are asking whether users can move from Base44 to Auth0, or to your own backend, with their existing passwords intact, given that Base44 does not provide password hashes in its user export.

## **[Root Cause]**

A standard user export does not include password hashes, so a plain export and import cannot carry passwords over. Auth0 accepts pre-existing hashes only through the `custom_password_hash` field in a bulk import, and only for supported algorithms and parameters.

## **[Solution]**

The standard, battle-tested solution for this: **[Lazy Migration](https://auth0.com/blog/how-to-migrate-users-to-auth0-a-technical-guide/#Automatic-User-Migration--Trickle-Lazy-Migration-)** (also known as **Just-in-Time (JIT) Migration** or **Shadow Authentication** ).

When a provider like Base44 does not expose password hashes (often due to security boundaries or platform lock-in), you cannot perform a bulk password import. However, you can intercept and capture credentials when users naturally log in.

Here is how you can implement this either directly in **Auth0** or in **your own backend:**

### **Option 1: Using Auth0’s Built-in Automatic Migration (Recommended)**

Auth0 natively supports this pattern out of the box through **Custom Database Connections** :

1. **Pre-seed User Profiles (Optional but recommended):**

2. **Enable Automatic Migration in Auth0:**

3. **Implement the** `Login` Script:

```auto
     function login(email, password, callback) {
       const request = require('request');

       // Call Base44's login API
       request.post({
         url: 'https://api.base44.com/v1/auth/login', // Base44 auth endpoint
         json: { email: email, password: password }
       }, function(err, response, body) {
         if (err) return callback(err);
         if (response.statusCode === 401 || response.statusCode === 403) {
           return callback(new WrongUsernameOrPasswordError(email));
         }
         if (response.statusCode !== 200) {
           return callback(new Error('Base44 authentication error'));
         }

         // Successfully authenticated against Base44
         return callback(null, {
           user_id: body.id || body.user_id,
           email: email,
           email_verified: body.email_verified || true,
           name: body.name
         });
       });
     }

```

- **What happens next:** Once Base44 returns a success code, Auth0 receives the callback, automatically hashes the password using bcrypt, and stores it in Auth0’s secure database. Subsequent logins authenticate directly against Auth0, completely bypassing Base44.

1. **Implement the** `Get User` Script (for Password Resets):

* * *

### **Option 2: Implementing Lazy Migration in Your Own Backend**

If you are handling authentication in your own service:

1. **Pre-populate your database:** Import existing users with a flag such as `migrated: false` and `password_hash: null`.

2. **On login request** (`POST /auth/login`):

3. The next time the user visits, they are authenticated entirely within your system.

### **[Migration Strategy & Edge Cases to Consider]**

- **The Long Tail (Inactive Users):**

- **Social Logins (Google, GitHub, Apple):**

- **MFA / 2FA:**

- **Contacting Base44 Support:**

Kind Regards,  
Nik