# Admin auth: password issue

**URL:** <https://discourse.nodered.org/t/admin-auth-password-issue/97815>\
**Category:** General\
**Tags:** security\
**Created:** [27 June 2025 08:01 UTC](https://discourse.nodered.org/t/admin-auth-password-issue/97815 "2025-06-27T08:01:43Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![mus-ab03](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/mus-ab03/32/101687_2.png) [@mus-ab03](https://discourse.nodered.org/u/mus-ab03)\
**Post date:** [27 June 2025 08:01 UTC](https://discourse.nodered.org/t/admin-auth-password-issue/97815/1 "2025-06-27T08:01:43Z")

</div>

I have node-red 4.0.9 running as a service using nssm, I set up the password using node-red-admin hash-pw. After a few days it seems that the password was changed automatically and I had to reset the password in settings.js again

Is this an issue or some setting that can be changed?

---

<div class="post-metadata">

**Author:** ![hardillb](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/hardillb/32/12373_2.png) [@hardillb](https://discourse.nodered.org/u/hardillb)\
**Post date:** [28 June 2025 20:35 UTC](https://discourse.nodered.org/t/admin-auth-password-issue/97815/2 "2025-06-28T20:35:25Z")

</div>

No, there is no way the password will change on it's own. The only way the password will change is if the `settings.js` file is edited.

If your Node-RED instance is exposed to the internet please make sure the username and password you pick are not trivially guessed (e.g. probably don't use "admin" as a username).

I would also double check all the tabs in your flows, especially scroll down and to the right to check nothing has been added.

---

<div class="post-metadata">

**Author:** ![TotallyInformation](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/totallyinformation/32/31_2.png) [@TotallyInformation](https://discourse.nodered.org/u/TotallyInformation)\
**Post date:** [29 June 2025 10:59 UTC](https://discourse.nodered.org/t/admin-auth-password-issue/97815/3 "2025-06-29T10:59:06Z")

</div>

As Ben implies, if you have connected this instance of Node-RED (or the device that runs it) to the Internet, please disconnect immediately.

There is lots of information in this forum on connecting Node-RED to the Internet relatively safely. If your device or Node-RED instance has been compromised, you may need to reset everything and change passwords before continuing.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/1X/d073cd938eafa2e558d7c2cd59003b3ef4963033.png) [@system](https://discourse.nodered.org/u/system)\
**Post date:** [13 July 2025 10:59 UTC](https://discourse.nodered.org/t/admin-auth-password-issue/97815/4 "2025-07-13T10:59:38Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.