# Invite URL password hash

**URL:** <https://devforum.zoom.us/t/invite-url-password-hash/3363>\
**Category:** API and Webhooks\
**Created:** [February 22, 2019, 3:32pm UTC](https://devforum.zoom.us/t/invite-url-password-hash/3363 "2019-02-22T15:32:16Z")\
**Posts on this page:** 17\
**Page:** 1

<div class="post-metadata">

**Author:** ![chaseadam](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/chaseadam/32/339_2.png) [@chaseadam](https://devforum.zoom.us/u/chaseadam)\
**Post date:** [February 22, 2019, 3:32pm UTC](https://devforum.zoom.us/t/invite-url-password-hash/3363/1 "2019-02-22T15:32:17Z")

</div>

Not quite REST API related, but couldn’t find a better place.

When creating a meeting with a password using the scheduler plugin, there is pwd parameter with what appears to be a hash of the numerical meeting password. What is the hash used?

Example:  
[https://xxx.zoom.us/j/602226XXX?pwd=UzlBbktJMjZib255L1huQlhkLzBvQT09](https://xxx.zoom.us/j/602226XXX?pwd=UzlBbktJMjZib255L1huQlhkLzBvQT09)

---

<div class="post-metadata">

**Author:** ![michael\_p.zoom](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/michael_p.zoom/32/18105_2.png) [@michael\_p.zoom](https://devforum.zoom.us/u/michael_p.zoom)\
**Post date:** [February 22, 2019, 4:57pm UTC](https://devforum.zoom.us/t/invite-url-password-hash/3363/2 "2019-02-22T16:57:06Z")

</div>

Hi @chaseadam,

The value of the pwd parameter is a hash that is essentially your meeting password encrypted.

Thanks

---

<div class="post-metadata">

**Author:** ![chaseadam](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/chaseadam/32/339_2.png) [@chaseadam](https://devforum.zoom.us/u/chaseadam)\
**Post date:** [February 22, 2019, 9:33pm UTC](https://devforum.zoom.us/t/invite-url-password-hash/3363/3 "2019-02-22T21:33:53Z")

</div>

Thanks! If I know the password of a meeting how do I generate the parameter?

---

<div class="post-metadata">

**Author:** ![chaseadam](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/chaseadam/32/339_2.png) [@chaseadam](https://devforum.zoom.us/u/chaseadam)\
**Post date:** [March 12, 2019, 9:18pm UTC](https://devforum.zoom.us/t/invite-url-password-hash/3363/4 "2019-03-12T21:18:40Z")

</div>

Checking back to see how this value is generated if I have the meeting ID and plaintext password.

---

<div class="post-metadata">

**Author:** ![michael\_p.zoom](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/michael_p.zoom/32/18105_2.png) [@michael\_p.zoom](https://devforum.zoom.us/u/michael_p.zoom)\
**Post date:** [March 19, 2019, 5:42pm UTC](https://devforum.zoom.us/t/invite-url-password-hash/3363/5 "2019-03-19T17:42:18Z")

</div>

Hi @chaseadam,

Are you referring to how to generate the hash correct? If so, its generated by our backend and not the user.

Thanks

---

<div class="post-metadata">

**Author:** ![jeckstein](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/jeckstein/32/4459_2.png) [@jeckstein](https://devforum.zoom.us/u/jeckstein)\
**Post date:** [March 30, 2020, 5:56am UTC](https://devforum.zoom.us/t/invite-url-password-hash/3363/6 "2020-03-30T05:56:56Z")

</div>

Hi Michael, We want to send the zoom meeting link with the password hash to our participants. If the Zoom backend generates the hash, how do we capture that without having access to it through the API?  
Thank you

---

<div class="post-metadata">

**Author:** ![tommy](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/tommy/32/72769_2.png) [@tommy](https://devforum.zoom.us/u/tommy)\
**Post date:** [March 30, 2020, 9:12pm UTC](https://devforum.zoom.us/t/invite-url-password-hash/3363/7 "2020-03-30T21:12:41Z")

</div>

Hey @jeckstein,

> [@jeckstein](#):
>
> We want to send the zoom meeting link with the password hash to our participants.

Can’t you just send the join\_url to your participants with the password in the query param?

Thanks,  
Tommy

---

<div class="post-metadata">

**Author:** ![bizstim.apps](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/bizstim.apps/32/3599_2.png) [@bizstim.apps](https://devforum.zoom.us/u/bizstim.apps)\
**Post date:** [April 1, 2020, 1:31am UTC](https://devforum.zoom.us/t/invite-url-password-hash/3363/8 "2020-04-01T01:31:09Z")

</div>

No Tommy you can’t because if the pwd is not hashed it does not recognize the password in the query param. I just tested it out without a hash and it asked for the password.

Are we allowed to know how to hash the password so we can send the join\_url with the correctly formatted pwd hash?

OR

If the meeting is created using the Zoom API and a password is provided does the API send back a response object with the hashed password in the join\_url value? Perhaps in a different key =\> value pair? The response object example in the documentation does not have a password set.

---

<div class="post-metadata">

**Author:** ![tommy](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/tommy/32/72769_2.png) [@tommy](https://devforum.zoom.us/u/tommy)\
**Post date:** [April 1, 2020, 7:18am UTC](https://devforum.zoom.us/t/invite-url-password-hash/3363/9 "2020-04-01T07:18:58Z")

</div>

Hey @bizstim.apps,

May I ask how the password is being generated? Are you creating one using the [Create Meeting endpoint](https://marketplace.zoom.us/docs/api-reference/zoom-api/meetings/meetingcreate), or is the Zoom Web Portal creating one for you?

Screenshot of the flow would be helpful.

Thanks,  
Tommy

---

<div class="post-metadata">

**Author:** ![bizstim.apps](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/bizstim.apps/32/3599_2.png) [@bizstim.apps](https://devforum.zoom.us/u/bizstim.apps)\
**Post date:** [April 2, 2020, 7:30pm UTC](https://devforum.zoom.us/t/invite-url-password-hash/3363/10 "2020-04-02T19:30:22Z")

</div>

The zoom API: **create meeting** has a password field so I send the following post array via the cURL procedure which will format it into a string, for example:

$password = 8 character numeric number that is generated by my server.

$post\_data = [  
‘topic’ =\> $session\_description,  
‘type’ =\> 2, //scheduled meeting  
‘start\_time’ =\> $session\_date.‘T’.$session\_start\_time.’:00’,  
‘duration’ =\> $session\_minutes,  
‘password’ =\> $password,  
‘settings’ =\> [  
‘host\_video’ =\> $host\_video,  
‘participant\_video’ =\> $participant\_video,  
‘cn\_meeting’ =\> $cn\_meeting,  
‘in\_meeting’ =\> $in\_meeting,  
‘join\_before\_host’ =\> $join\_before\_host,  
‘mute\_upon\_entry’ =\> $mute\_upon\_entry,  
‘watermark’ =\> $watermark,  
‘audio’ =\> (string) $getZoomSettings[‘audio’],  
‘auto\_recording’ =\> (string) $getZoomSettings[‘auto\_recording’],  
‘enforce\_login’ =\> $enforce\_login,  
‘waiting\_room’ =\> $waiting\_room  
]  
];

If the password field is populated within the request, will ZOOM send a response with a join\_url and start\_url with “?pwd=\<hashed\_password\>” within the response? Is there an additional key=\>value pair provided within the response to show the hashed password? OR, do we have to send the link and password separately to our customers?

I ask because the documentation does not have an example of a request-response for a set password.

Thanks for your time and patience.

---

<div class="post-metadata">

**Author:** ![tommy](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/tommy/32/72769_2.png) [@tommy](https://devforum.zoom.us/u/tommy)\
**Post date:** [April 3, 2020, 3:44am UTC](https://devforum.zoom.us/t/invite-url-password-hash/3363/11 "2020-04-03T03:44:40Z")

</div>

Hey @bizstim.apps, and everyone,

Here is a the request/response from a meeting I just created with a password:

POST [https://api.zoom.us/v2/users/me/meetings](https://api.zoom.us/v2/users/me/meetings)

BODY:

```json
{
	"topic":"Test Password",
	"type":2,
	"start_time": "2020:04:05T00:00:00Z",
	"duration": 30,
	"password": "1234@"
}

```

Response:

```json
{
    "uuid": "",
    "id":,
    "host_id": "",
    "topic": "Test Password",
    "type": 2,
    "status": "waiting",
    "start_time": "2020-04-03T03:39:39Z",
    "duration": 30,
    "timezone": "America/Denver",
    "created_at": "2020-04-03T03:39:39Z",
    "start_url": "",
    "join_url": "https://tommygaessler.zoom.us/j/meetingID?pwd=UjJQTENnamVFMEpQN2tVUHRHZmY4Zz09",
    "password": "1234@",
    "h323_password": "232607",
    "pstn_password": "232607",
    "encrypted_password": "UjJQTENnamVFMEpQN2tVUHRHZmY4Zz09",
    "pmi": "",
    "settings": {
...

```

As you can see there are variations of the password, and the join\_url has the encrypted password already so clicking on the join\_url will automatically pass in the password.

If typing in the password, you will use in the numeric password.

Does that clear things up?

The hash is generated via our backend and we cannot share the algorithm that does this to generate the hash with the plain text meeting password.

Thanks,  
Tommy

---

<div class="post-metadata">

**Author:** ![bizstim.apps](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/bizstim.apps/32/3599_2.png) [@bizstim.apps](https://devforum.zoom.us/u/bizstim.apps)\
**Post date:** [April 4, 2020, 7:56pm UTC](https://devforum.zoom.us/t/invite-url-password-hash/3363/12 "2020-04-04T19:56:52Z")

</div>

Perfect. That is exactly what I needed. Thank you.

---

<div class="post-metadata">

**Author:** ![tommy](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/tommy/32/72769_2.png) [@tommy](https://devforum.zoom.us/u/tommy)\
**Post date:** [April 6, 2020, 4:54pm UTC](https://devforum.zoom.us/t/invite-url-password-hash/3363/13 "2020-04-06T16:54:33Z")

</div>

You are welcome! 🙂

Thanks,  
Tommy

---

<div class="post-metadata">

**Author:** ![isaacly](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/isaacly/32/7504_2.png) [@isaacly](https://devforum.zoom.us/u/isaacly)\
**Post date:** [June 3, 2020, 11:31am UTC](https://devforum.zoom.us/t/invite-url-password-hash/3363/14 "2020-06-03T11:31:13Z")

</div>

> [@tommy](#):
>
> `UjJQTENnamVFMEpQN2tVUHRHZmY4Zz09`

Looks like this is double base64 encoded 🤦‍♂️

```
$ pbpaste | base64 -d
R2PLCgjeE0JP7kUPtGff8g== ➜ app 
$ pbpaste | base64 -d | base64 -d
<binary data>

```

---

<div class="post-metadata">

**Author:** ![michael.zoom](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/michael.zoom/32/37213_2.png) [@michael.zoom](https://devforum.zoom.us/u/michael.zoom)\
**Post date:** [June 5, 2020, 11:54pm UTC](https://devforum.zoom.us/t/invite-url-password-hash/3363/15 "2020-06-05T23:54:03Z")

</div>

Hi @isaacly if you’re looking for additional protection on meetings, I’d suggest also implementing unique join\_urls by requiring [meeting registration](https://support.zoom.us/hc/en-us/articles/211579443-Registration-for-Meetings). Adding a registrant to a meeting via API will generate unique join urls in the response.

---

<div class="post-metadata">

**Author:** ![tommy](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/tommy/32/72769_2.png) [@tommy](https://devforum.zoom.us/u/tommy)\
**Post date:** [June 17, 2020, 6:36am UTC](https://devforum.zoom.us/t/invite-url-password-hash/3363/17 "2020-06-17T06:36:55Z")

</div>

Closing this topic.

Thanks,  
Tommy

---

<div class="post-metadata">

**Author:** ![tommy](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/tommy/32/72769_2.png) [@tommy](https://devforum.zoom.us/u/tommy)\
**Post date:** [June 17, 2020, 6:36am UTC](https://devforum.zoom.us/t/invite-url-password-hash/3363/18 "2020-06-17T06:36:59Z")

</div>

Closed on June 17, 2020, 6:36am UTC