Users moved from Supabase now sign in with the email and password they already have, under the same user id, so their data and row-level policies keep matching them.
What's new
Same user ids. Users imported from Supabase keep the ids they had there. Rows that reference auth.users and policies built on auth.uid() keep matching the same people, so a signed-in user sees exactly the data they saw before.
Same passwords. Give the import your Supabase database password and users sign in with the password they already use — no reset, no email. The first sign-in checks it against the password stored at Supabase and keeps it from then on. Without the database password, accounts still arrive and users reset their password once.
Faithful accounts. Email confirmation, bans and sign-up dates carry over. Imports of thousands of users are much faster, and one bad record no longer holds up the rest.
Clear reporting. The import summary shows how many users came with their password, and warns when an email already belonged to a different account in the project.
If a project's password rules are stricter than Supabase's, a user whose old password falls short is told so with password_reset_required and can choose a new one.