# Change the hashing algorithm for FastStats systems

Following the deprecation of the SHA-1 hash function, it's no longer recommended for use with digital signatures. Apteco recommends that all FastStats systems move from SHA-1 to at least SHA-256 as soon as possible.

If your FastStats system is still set to the SHA-1 security hash method, follow the steps below to upgrade to your preferred hash method.

## Changing the hash method for FastStats

To change the hash method for FastStats:

1. Ask all users to log out.
2. Open the **FastStats Web Service Configurator**.
3. Select **System**, then **Security**.
4. Set **Hash method** to the desired level (**SHA-256** minimum).

   You must then reset all users' passwords.
5. Open the **FastStats Configurator**.
6. Select **File**, then **Generate Password Hash**.
7. Enter `password` in the Password box, select the new hashing method used in the previous step, and select **Generate** (if using password salt, check the **Generate salt** box).

   The **FastStats Configurator** populates the **Hash** box with the hashed version of `password`.
8. Update the **Users** table in the control database (WS DB) to change all users' passwords and turn on a flag to force them to change their password on next login. Use the following SQL script, substituting your actual database name for `AcmeInc`:

   SQL

   ```sql
   USE AcmeInc

   UPDATE dbo.Users
   SET [Password] = 'daa0ae2248187da55ce3b006831cd0e76d22a03f84dc09a3497a58f2d02f8d1f' --generated hashed password
     , PasswordManuallyExpired = 1
   ```
9. Users can now log back into FastStats using the password `password`. FastStats prompts them to change their password before they can continue.

## Changing the hash method for Orbit

If the system also has Orbit running, you may need to update the hash method in the Orbit API Configurator.

To change the hash method in Orbit:

1. Open the **FastStats Orbit Updater Configurator**.
2. In the **API** section, select **Open API Configurator**.
3. In **General** \> **FS Config database**, if the connection string field contains a valid FS\_Config connection string, the changes made in the FastStats Configurator appear automatically.
4. If not populated, go to the **DataView** tab \> **Session service** and change the **Hashing algorithm** to match the method set in the FastStats Web Service Configurator.
5. **Save** and close the Orbit API Configurator.