Password migration that does not force your users to reset
Password migration is moving users' passwords from one identity system to another so they can keep signing in with the password they already use. You either import the stored password hashes, when the new system supports their algorithm, or check each password against the old system at the next sign-in and store it again (lazy migration). The Skycloak Platform is built to import Keycloak users with their passwords, so nobody resets a password on the day of the move.
Why forced password resets lose users
The simplest way to move users is to skip the passwords and ask everyone to set a new one. It sounds harmless, but each reset sends the user a message, asks them to stop what they were doing and come back, and some of them never finish. Users who signed up long ago may no longer use the inbox they registered with, and they stay locked out until support helps them. For a product, every user who does not come back after a reset is a customer lost for a reason that had nothing to do with the product.
A mass reset also looks suspicious, because a sudden message asking every user to change their password is exactly what a phishing campaign looks like. Support teams see a wave of tickets in the days after, and attackers can take advantage of the confusion by sending their own fake reset messages. Moving the passwords themselves avoids all of this, because users notice nothing on the day of the switch. There are two ways to do it, and most migrations use one or both.
Importing password hashes versus rehashing at the next sign-in
Identity systems do not store passwords but a hash of each one: the output of a one-way function that turns a password into a value that cannot be turned back, usually mixed with a random value called a salt. When the new system supports the same hashing algorithm, such as bcrypt or PBKDF2, you can import the hashes with their salts and settings, and users sign in on the new system straight away. This is the cleanest path, since every user moves at once and the old system can be switched off, but it only works when the old system lets you export the hashes and the new system can verify that algorithm.
When the hashes cannot be imported, lazy migration moves users one at a time as they sign in. The new system receives the password at sign-in, checks it against the old system and, if it is correct, stores a hash of its own, so the next sign-in no longer needs the old system. In exchange, the old system has to keep running until most users have signed in, and users who never come back still need a reset at the end. Many teams combine the two approaches, importing what they can and rehashing the rest.
How the Skycloak Platform carries passwords, MFA and passkeys over
The Platform is built to import a Keycloak realm's users with their passwords, so the hashes come across and users sign in with the password they already know. The same import carries over their multi-factor authentication settings and their passkeys, so users do not have to enrol a second factor again. A passkey is a sign-in credential stored on the user's device that replaces the password with a cryptographic key, and it is tied to the domain it was created for, so the sign-in domain is worth planning before the move. Migration kits for other identity providers are planned for later.
Once users are on the Platform, the sign-in features on its plan apply to them, including a check of passwords against the Have I Been Pwned breached password data, which falls back to a local copy if that service is unavailable. Applications keep working through Keycloak-compatible addresses and token shapes, and a tenant can be exported back to a Keycloak realm file if you need to reverse the move. All of this is planned rather than live today, and a demo shows which parts you can use now. If you are moving from another provider, that conversation is also a good place to talk through how your users' passwords are stored today and which approach fits.
Frequently asked questions
Can I migrate passwords without users noticing?
Yes, either by importing the hashes or by rehashing at the next sign-in. In both cases users keep signing in with the password they already use, and only users who never sign in during a lazy migration need a reset at the end.
Which providers can the Skycloak Platform import passwords from?
The Platform is built to import Keycloak realms with users' passwords, MFA and passkeys. Migration kits for other identity providers are planned for later.
See the Skycloak Platform for yourself
Book a demo and we will walk you through the Platform with your own sign-in flows in mind.