diff --git a/go.mod b/go.mod
index 6e9ab4b..af9ff0a 100644
--- a/go.mod
+++ b/go.mod
@@ -8,6 +8,12 @@ require (
 	golang.zabbix.com/sdk v1.2.2-0.20250820065059-02a8663d48d2
 )
 
+require (
+	github.com/xdg-go/pbkdf2 v1.0.0 // indirect
+	github.com/xdg-go/stringprep v1.0.4 // indirect
+	golang.org/x/text v0.28.0 // indirect
+)
+
 require (
 	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/eapache/go-resiliency v1.7.0 // indirect
@@ -23,6 +29,7 @@ require (
 	github.com/klauspost/compress v1.18.0 // indirect
 	github.com/pierrec/lz4/v4 v4.1.22 // indirect
 	github.com/rcrowley/go-metrics v0.0.0-20250401214520-65e299d6c5c9 // indirect
+	github.com/xdg-go/scram v1.1.2
 	golang.org/x/crypto v0.41.0 // indirect
 	golang.org/x/net v0.43.0 // indirect
 	golang.org/x/sys v0.35.0 // indirect
diff --git a/go.sum b/go.sum
index 50cdc20..4d825be 100644
--- a/go.sum
+++ b/go.sum
@@ -49,6 +49,12 @@ github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO
 github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
 github.com/stretchr/testify v1.11.0 h1:ib4sjIrwZKxE5u/Japgo/7SJV3PvgjGiRNAvTVGqQl8=
 github.com/stretchr/testify v1.11.0/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
+github.com/xdg-go/pbkdf2 v1.0.0 h1:Su7DPu48wXMwC3bs7MCNG+z4FhcyEuz5dlvchbq0B0c=
+github.com/xdg-go/pbkdf2 v1.0.0/go.mod h1:jrpuAogTd400dnrH08LKmI/xc1MbPOebTwRqcT5RDeI=
+github.com/xdg-go/scram v1.1.2 h1:FHX5I5B4i4hKRVRBCFRxq1iQRej7WO3hhBuJf+UUySY=
+github.com/xdg-go/scram v1.1.2/go.mod h1:RT/sEzTbU5y00aCK8UOx6R7YryM0iF1N2MOmC3kKLN4=
+github.com/xdg-go/stringprep v1.0.4 h1:XLI/Ng3O1Atzq0oBs3TWm+5ZVgkq2aqdlvP9JtoZ6c8=
+github.com/xdg-go/stringprep v1.0.4/go.mod h1:mPGuuIYwz7CmR2bT9j4GbQqutWS1zV24gijq1dTyGkM=
 github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
@@ -82,7 +88,10 @@ golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
+golang.org/x/text v0.3.8/go.mod h1:E6s5w1FMmriuDzIBO73fBruAKo1PCIq6d2Q6DHfQ8WQ=
 golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
+golang.org/x/text v0.28.0 h1:rhazDwis8INMIwQ4tpjLDzUhx6RlXqZNPEM0huQojng=
+golang.org/x/text v0.28.0/go.mod h1:U8nCwOR8jO/marOQ0QbDiOngZVEBB7MAiitBuMjXiNU=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
diff --git a/kafka/kafka.go b/kafka/kafka.go
index c07c010..b9e28ae 100644
--- a/kafka/kafka.go
+++ b/kafka/kafka.go
@@ -15,12 +15,15 @@
 package kafka
 
 import (
+	"crypto/sha256"
+	"crypto/sha512"
 	"crypto/tls"
 	"net"
 	"strings"
 	"time"
 
 	"github.com/IBM/sarama"
+	"github.com/xdg-go/scram"
 	"golang.zabbix.com/sdk/errs"
 	"golang.zabbix.com/sdk/log"
 	"golang.zabbix.com/sdk/tlsconfig"
@@ -62,6 +65,35 @@ type Configuration struct {
 	Timeout        int    `conf:"default=1"`
 	TLSAuth        bool   `conf:"default=false"`
 	EnableTLS      bool   `conf:"optional"`
+	SASLAlgorithm  string `conf:"optional"`
+}
+
+// XDGSCRAMClient defines SCRAM client
+type XDGSCRAMClient struct {
+	*scram.Client
+	*scram.ClientConversation
+	scram.HashGeneratorFcn
+}
+
+// Begin creates the SCRAM client
+func (x *XDGSCRAMClient) Begin(userName, password, authzID string) (err error) {
+	x.Client, err = x.HashGeneratorFcn.NewClient(userName, password, authzID)
+	if err != nil {
+		return err
+	}
+	x.ClientConversation = x.Client.NewConversation()
+	return nil
+}
+
+// Step is the adapter with the step for the SCRAM client
+func (x *XDGSCRAMClient) Step(challenge string) (response string, err error) {
+	response, err = x.ClientConversation.Step(challenge)
+	return
+}
+
+// Done ends the connection for the SCRAM client
+func (x *XDGSCRAMClient) Done() bool {
+	return x.ClientConversation.Done()
 }
 
 // NewProducer creates Kafka producers from with provided configuration.
@@ -104,6 +136,7 @@ func NewProducer(c *Configuration) (*DefaultProducer, error) {
 		c.Retry,
 		c.TLSAuth,
 		c.EnableTLS,
+		c.SASLAlgorithm,
 		time.Duration(c.Timeout)*time.Second,
 		time.Duration(c.KeepAlive)*time.Second,
 		tlsConfig,
@@ -214,6 +247,7 @@ func newConfig(
 	retries int,
 	tlsAuth,
 	enableTLS bool,
+	saslAlgorithm string,
 	timeout,
 	keepAlive time.Duration,
 	tlsConf *tls.Config,
@@ -242,6 +276,19 @@ func newConfig(
 		config.Net.SASL.Enable = true
 		config.Net.SASL.User = username
 		config.Net.SASL.Password = password
+
+		switch saslAlgorithm {
+		case "scram-sha-512":
+			config.Net.SASL.Mechanism = sarama.SASLTypeSCRAMSHA512
+			config.Net.SASL.SCRAMClientGeneratorFunc = func() sarama.SCRAMClient {
+				return &XDGSCRAMClient{HashGeneratorFcn: sha512.New}
+			}
+		case "scram-sha-256":
+			config.Net.SASL.Mechanism = sarama.SASLTypeSCRAMSHA256
+			config.Net.SASL.SCRAMClientGeneratorFunc = func() sarama.SCRAMClient {
+				return &XDGSCRAMClient{HashGeneratorFcn: sha256.New}
+			}
+		}
 	}
 
 	if tlsAuth {
diff --git a/kafka/kafka_test.go b/kafka/kafka_test.go
index d724779..66104aa 100644
--- a/kafka/kafka_test.go
+++ b/kafka/kafka_test.go
@@ -27,14 +27,15 @@ func Test_newConfig(t *testing.T) {
 	t.Parallel()
 
 	type args struct {
-		username  string
-		password  string
-		retries   int
-		tlsAuth   bool
-		enableTLS bool
-		timeout   time.Duration
-		keepAlive time.Duration
-		tlsConf   *tls.Config
+		username      string
+		password      string
+		retries       int
+		tlsAuth       bool
+		enableTLS     bool
+		saslMechanism string
+		timeout       time.Duration
+		keepAlive     time.Duration
+		tlsConf       *tls.Config
 	}
 
 	tests := []struct {
@@ -62,6 +63,7 @@ func Test_newConfig(t *testing.T) {
 				2,
 				false,
 				false,
+				"",
 				3,
 				30,
 				nil,
@@ -81,13 +83,68 @@ func Test_newConfig(t *testing.T) {
 			false,
 		},
 		{
-			"+SASL",
+			"+SASL-PLAIN",
+			args{
+				"username",
+				"password",
+				2,
+				false,
+				false,
+				"",
+				3,
+				30,
+				nil,
+			},
+			"zabbix",
+			"username",
+			"password",
+			30,
+			3,
+			3,
+			3,
+			2,
+			true,
+			false,
+			false,
+			false,
+			false,
+		},
+		{
+			"+SASL-SCRAM-SHA-256",
+			args{
+				"username",
+				"password",
+				2,
+				false,
+				false,
+				"scram-sha-256",
+				3,
+				30,
+				nil,
+			},
+			"zabbix",
+			"username",
+			"password",
+			30,
+			3,
+			3,
+			3,
+			2,
+			true,
+			false,
+			false,
+			false,
+			false,
+		},
+		{
+			"+SASL-SCRAM-SHA-512",
 			args{
 				"username",
 				"password",
 				2,
 				false,
 				false,
+				"scram-sha-512",
 				3,
 				30,
 				nil,
@@ -114,6 +171,7 @@ func Test_newConfig(t *testing.T) {
 				2,
 				true,
 				false,
+				"",
 				3,
 				30,
 				&tls.Config{ServerName: "127.0.0.1"}, //nolint:gosec // struct fields are not used
@@ -140,6 +198,7 @@ func Test_newConfig(t *testing.T) {
 				2,
 				true,
 				true,
+				"",
 				3,
 				30,
 				&tls.Config{ServerName: "127.0.0.1"}, //nolint:gosec // struct fields are not used
@@ -170,6 +229,7 @@ func Test_newConfig(t *testing.T) {
 				tt.args.retries,
 				tt.args.tlsAuth,
 				tt.args.enableTLS,
+				tt.args.saslMechanism,
 				tt.args.timeout,
 				tt.args.keepAlive,
 				tt.args.tlsConf,
diff --git a/kafka_connector.conf b/kafka_connector.conf
index b88ea2e..c8ec8b2 100644
--- a/kafka_connector.conf
+++ b/kafka_connector.conf
@@ -185,6 +185,16 @@ Kafka.URL=localhost
 # Default:
 # Kafka.TLSAuth=false
 
+### Option: Kafka.SASLAlgorithm
+#	SASL algorithm for SASL authorization. If no algorithm is provided, SASL_PLAIN will be used for authorization.
+#   Specifies SASL algorithm:
+#	scram-sha-256
+#	scram-sha-512
+#
+# Mandatory: no
+# Default:
+# Kafka.SASLAlgorithm=
+
 ### Option: Kafka.CaFile
 #	CA file location for outgoing request TLS verification.
 #
