diff --git a/src/userdb.js b/src/userdb.js
index 19cd698f9..40b54d4e1 100644
--- a/src/userdb.js
+++ b/src/userdb.js
@@ -42,9 +42,8 @@ function postProcess(result) {
     result.twoFactorAuthenticationEnabled = !!result.twoFactorAuthenticationEnabled;
     result.active = !!result.active;
 
-    // we have a locations property to not store top-level array
-    const loginLocations = safe.JSON.parse(result.loginLocationsJson) || {};
-    result.loginLocations = loginLocations.locations || [];
+    result.loginLocations = safe.JSON.parse(result.loginLocationsJson) || [];
+    if (!Array.isArray(result.loginLocations)) result.loginLocations = [];
     delete result.loginLocationsJson;
 
     return result;
@@ -254,7 +253,7 @@ function update(userId, user, callback) {
             args.push(user[k] ? 1 : 0);
         } else if (k === 'loginLocations') {
             fields.push('loginLocationsJson = ?');
-            args.push(JSON.stringify({ locations: user[k] }));
+            args.push(JSON.stringify(user[k]));
         } else {
             fields.push(k + ' = ?');
             args.push(user[k]);