Hacker News Reader

Hash password in your application. Probably it's not compatible with that postgraphile thing, it's more general advice.

And if you’re using a language that supports it, pass passwords around in a custom data type/wrapper around string that does not leak its contents when your platform equivalent of .toString() is called (and override the JSON or slog conversion interface).

Another method, which has worked for me, is to never store passwords in the database at all but in a separate authenticator like Google Auth or AWS Cognito. Then the authenticated username is passed in via signed JWT. The database can perform authorization, but authentication (and authentication method) are kept far away from the data in your database.

Postgresql has built in crypt and gen_salt functions which may be good enough for your security requirements.