Use hash for user passwords in config file #1791

New Issue

MrUnknownDE · 2026-04-05T19:41:58+02:00

MrUnknownDE commented

2026-04-05 19:41:58 +02:00

Originally created by @RichyHBM on 2/11/2025

Currently the password is saved in plain text which makes it insecure when committing to repos etc. Ideally the installer script would hash the password and then save it to the config in that format.

Imagine the short term migration could be, check user submitted password hashed matches stored hashed password, otherwise just check if both are the same (to account for users that may not have hashed passwords when upgrading)

Bcrypt seems to be a good standard these days

*Originally created by @RichyHBM on 2/11/2025* Currently the password is saved in plain text which makes it insecure when committing to repos etc. Ideally the installer script would hash the password and then save it to the config in that format. Imagine the short term migration could be, check user submitted password hashed matches stored hashed password, otherwise just check if both are the same (to account for users that may not have hashed passwords when upgrading) Bcrypt seems to be a good standard these days

MrUnknownDE closed this issue

2026-04-05 19:41:58 +02:00

Sign in to join this conversation.

Branches Tags

main

dev

dependabot/npm_and_yarn/dev-minor-updates-b4e5d6b9c5

revert-2766-feature/systemd-install-instructions

dependabot/npm_and_yarn/prod-patch-updates-05702d39f2

dependabot/npm_and_yarn/next-16.2.1

dependabot/npm_and_yarn/recharts-3.8.1

alerting-rules

private-site-ha

dependabot/docker/docker/library/node-25-slim

ssh

delete-account

msg-delivery

org-only-idp

cicd

patch

site-targets-auto-login

No Label

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github/pangolin#1791