Admin token Argon2 hashing support #1723

New Issue

MrUnknownDE · 2026-04-06T02:16:52+02:00

MrUnknownDE commented

2026-04-06 02:16:52 +02:00

Originally created by @BlackDex on 2/28/2023

Added support for Argon2 hashing support for the ADMIN_TOKEN instead of only supporting a plain text string.

The hash must be a PHC string which can be generated via the argon2 CLI or via the also built-in hash command in Vaultwarden.

You can simply run vaultwarden hash to generate a hash based upon a password the user provides them self.

Added a warning during startup and within the admin settings panel is the ADMIN_TOKEN is not an Argon2 hash.

Within the admin environment a user can ignore that warning and it will not be shown for at least 30 days. After that the warning will appear again unless the ADMIN_TOKEN has be converted to an Argon2 hash.

I have also tested this on my RaspberryPi 2b and there the Bitwarden preset takes almost 4.5 seconds to generate/verify the Argon2 hash.

Using the OWASP preset it is below 1 second, which I think should be fine for low-graded hardware.
If it is needed people could use lower memory settings, but in those cases I even doubt Vaultwarden it self would run.
They can always use the argon2 CLI and generate a faster hash.

Examples

ADMIN_TOKEN='$argon2i$v=19$m=4096,t=3,p=1$Saf.....'
ADMIN_TOKEN='$argon2d$v=19$m=4096,t=3,p=1$drh.....'
ADMIN_TOKEN='$argon2id$v=19$m=4096,t=3,p=1$ds.....'

I also created some documentation on the wiki regarding this feature already.
https://github.com/dani-garcia/vaultwarden/wiki/Enabling-admin-page#secure-the-admin_token

*Originally created by @BlackDex on 2/28/2023* Added support for Argon2 hashing support for the `ADMIN_TOKEN` instead of only supporting a plain text string. The hash must be a PHC string which can be generated via the `argon2` CLI **or** via the also built-in hash command in Vaultwarden. You can simply run `vaultwarden hash` to generate a hash based upon a password the user provides them self. Added a warning during startup and within the admin settings panel is the `ADMIN_TOKEN` is not an Argon2 hash. Within the admin environment a user can ignore that warning and it will not be shown for at least 30 days. After that the warning will appear again unless the `ADMIN_TOKEN` has be converted to an Argon2 hash. I have also tested this on my RaspberryPi 2b and there the `Bitwarden` preset takes almost 4.5 seconds to generate/verify the Argon2 hash. Using the `OWASP` preset it is below 1 second, which I think should be fine for low-graded hardware. If it is needed people could use lower memory settings, but in those cases I even doubt Vaultwarden it self would run. They can always use the `argon2` CLI and generate a faster hash. Examples ```bash ADMIN_TOKEN='$argon2i$v=19$m=4096,t=3,p=1$Saf.....' ADMIN_TOKEN='$argon2d$v=19$m=4096,t=3,p=1$drh.....' ADMIN_TOKEN='$argon2id$v=19$m=4096,t=3,p=1$ds.....' ``` I also created some documentation on the wiki regarding this feature already. https://github.com/dani-garcia/vaultwarden/wiki/Enabling-admin-page#secure-the-admin_token

MrUnknownDE closed this issue

2026-04-06 02:16:53 +02:00

Sign in to join this conversation.

No Label

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github/vaultwarden#1723