Currently we use md5 passwords for new postgres users. This is obviously not ideal but has largely been the standard for postgres users historically. Postgres allows the use of SCRAM-SHA-256 and we use Postgres 11 across the board on maps, netbox and puppetdb. The challenge is figuring out whether our clients will support this authentication method, and if not trying to move them towards supporting them.