diff --git a/keyserver/src/responders/user-responders.js b/keyserver/src/responders/user-responders.js
--- a/keyserver/src/responders/user-responders.js
+++ b/keyserver/src/responders/user-responders.js
@@ -768,6 +768,7 @@
     initialNotificationsEncryptedMessage: t.String,
     doNotRegister: t.Boolean,
     source: t.maybe(t.enums.of(values(authActionSources))),
+    password: t.maybe(tPassword),
   });
 
 async function keyserverAuthResponder(
@@ -780,6 +781,7 @@
     initialContentEncryptedMessage,
     initialNotificationsEncryptedMessage,
     doNotRegister,
+    password,
   } = request;
   const calendarQuery = normalizeCalendarQuery(request.calendarQuery);
 
@@ -847,15 +849,17 @@
       return;
     }
 
+    const hash = password ? bcrypt.hashSync(password) : null;
     const time = Date.now();
     const newUserRow = [
       userID,
       username,
       inboundKeysForUser.walletAddress,
+      hash,
       time,
     ];
     const newUserQuery = SQL`
-      INSERT INTO users(id, username, ethereum_address, creation_time)
+      INSERT INTO users(id, username, ethereum_address, hash, creation_time)
       VALUES ${[newUserRow]}
   `;
     await dbQuery(newUserQuery);
diff --git a/lib/actions/user-actions.js b/lib/actions/user-actions.js
--- a/lib/actions/user-actions.js
+++ b/lib/actions/user-actions.js
@@ -699,6 +699,14 @@
 
     const keyserverIDs = Object.keys(keyserverData);
 
+    const authKeyserverID = authoritativeKeyserverID();
+    if (restLogInInfo.password) {
+      invariant(
+        keyserverIDs.length === 1 && keyserverIDs[0] === authKeyserverID,
+        'passing password to non-auth keyserver',
+      );
+    }
+
     const watchedIDsPerKeyserver = sortThreadIDsPerKeyserver(watchedIDs);
     const calendarQueryPerKeyserver = sortCalendarQueryPerKeyserver(
       calendarQuery,
@@ -767,7 +775,6 @@
       };
     }
 
-    const authKeyserverID = authoritativeKeyserverID();
     let userInfos: $ReadOnlyArray<UserInfo> = [];
     if (responses[authKeyserverID]) {
       const userInfosArrays = [
diff --git a/lib/keyserver-conn/keyserver-auth.js b/lib/keyserver-conn/keyserver-auth.js
--- a/lib/keyserver-conn/keyserver-auth.js
+++ b/lib/keyserver-conn/keyserver-auth.js
@@ -34,6 +34,7 @@
   +setInProgress: boolean => mixed,
   +hasBeenCancelled: () => boolean,
   +doNotRegister: boolean,
+  +password?: ?string,
 };
 
 type RawKeyserverAuthFunc =
@@ -84,6 +85,7 @@
           setInProgress,
           hasBeenCancelled,
           doNotRegister,
+          password,
         } = inputs;
         try {
           const [keyserverKeys] = await Promise.all([
@@ -138,6 +140,7 @@
               },
             },
             preRequestUserInfo: currentUserInfo,
+            password,
           });
 
           void dispatchActionPromise(keyserverAuthActionTypes, authPromise);
diff --git a/lib/types/account-types.js b/lib/types/account-types.js
--- a/lib/types/account-types.js
+++ b/lib/types/account-types.js
@@ -239,6 +239,7 @@
   +deviceTokenUpdateInput: DeviceTokenUpdateInput,
   +authActionSource: AuthActionSource,
   +keyserverData: { +[keyserverID: string]: KeyserverRequestData },
+  +password?: ?string,
 };
 
 export type KeyserverAuthRequest = $ReadOnly<{
@@ -251,6 +252,7 @@
   +watchedIDs: $ReadOnlyArray<string>,
   +platformDetails: PlatformDetails,
   +source?: AuthActionSource,
+  +password?: ?string,
 }>;
 
 export type UpdatePasswordRequest = {
diff --git a/native/account/registration/registration-server-call.js b/native/account/registration/registration-server-call.js
--- a/native/account/registration/registration-server-call.js
+++ b/native/account/registration/registration-server-call.js
@@ -456,6 +456,7 @@
           setInProgress: () => {},
           hasBeenCancelled: () => false,
           doNotRegister: false,
+          password: credentialsToSave?.password,
         });
         setCurrentStep({
           step: 'authoritative_keyserver_registration_dispatched',