---
schema_version: "1"
id: 5d0e4d4bfb346f0598bd00aa02f09175ae3c3e534b87b6358f19edd2d4c99256
title: Triple DES for SAML Single Sign-On Stops Working in Summer ’26
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/release-notes/260-0-0/rn_security_triple_des_retirement_updated.md
canonical_url: https://help.salesforce.com/s/articleView?id=release-notes.rn_security_triple_des_retirement_updated.htm&release=260&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: b9030bf935a3d9ebd4e5ddde59c4e6eda261170dc4bee7493a8f308783dc10d8
description: In Summer ’26, SAML single sign-on (SSO) configurations that use the Triple Data Encryption Standard (Triple DES) algorithm will stop working. This change applies to all SSO configurations that use the Triple DES algorithm, whether you use Salesforce as an identity provider or as a service provider. To improve security, use the Advanced Encryption Standard (AES) algorithms, AES 128 or AES 256, instead.
products:
  - Cross Cloud Packages Solutions
release: "260"
---
# Triple DES for SAML Single Sign-On Stops Working in Summer ’26

In Summer ’26, SAML single sign-on (SSO) configurations that use the Triple Data Encryption Standard (Triple DES) algorithm will stop working. This change applies to all SSO configurations that use the Triple DES algorithm, whether you use Salesforce as an identity provider or as a service provider. To improve security, use the Advanced Encryption Standard (AES) algorithms, AES 128 or AES 256, instead.

**Where:** This change applies to Lightning Experience and Salesforce Classic (not available in all orgs) in all editions.

**When:** Triple DES will stop working in Summer ’26. There’s no change to Triple DES support in Spring ’26, but we recommend that you update your SAML configurations as soon as possible.

**Why:** The Triple DES algorithm uses a cryptographic key that’s too short to be secure. The AES 128 and AES 256 algorithms use longer keys that make these algorithms harder to attack. For more information about encryption algorithm security from the National Institute of Standards and Technology, go to [https://csrc.nist.gov/pubs/sp/800/131/a/r3/ipd](https://csrc.nist.gov/pubs/sp/800/131/a/r3/ipd).

**How:** Before Summer ’26, update your configurations to use the AES 128 or AES 256 algorithm. The steps to update your configuration are different depending on whether you use Salesforce as an identity provider or as a service provider.

- If you use Salesforce as an identity provider, check your connected app SAML configuration. First, go to your connected app Web App Settings and check the Block Encryption Algorithm setting. If Block Encryption Algorithm is set to Triple DES, update your configuration to use a more secure algorithm. On the service provider, update your settings to decrypt the new algorithm.
    
    ![Block Encryption Algorithm setting with value set to Triple DES in connected app Web App Settings](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-salesforce_release_notes-260-0-0-production-enus/ba62a63b-6cd1-440e-8d24-e867afab0363/salesforce_release_notes/images/security/triple_des_connected_app_spring26.png)
- If you use Salesforce as a service provider, check with your identity provider to see what encryption algorithm they use. If they use the Triple DES algorithm, work with your identity provider to use a more secure algorithm and to generate a new decryption certificate. In Salesforce, update the Assertion Decryption Certificate in your SAML Single Sign-On Settings.
    
    ![Assertion Decryption Certificate field in SAML Single Sign-On Settings](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-salesforce_release_notes-260-0-0-production-enus/ba62a63b-6cd1-440e-8d24-e867afab0363/salesforce_release_notes/images/security/triple_des_sso_spring26.png)

#### See Also

- [_Salesforce Help_: Configure SSO with Salesforce as a SAML Service Provider](https://help.salesforce.com/s/articleView?id=xcloud.sso_saml.htm&language=en_US)
- [_Salesforce Help_: Salesforce as a SAML Identity Provider](https://help.salesforce.com/s/articleView?id=xcloud.sso_sfdc_idp_saml_parent.htm&language=en_US)