# Node-red nodes and password

**URL:** <https://discourse.nodered.org/t/node-red-nodes-and-password/28740>\
**Category:** General\
**Created:** [22 June 2020 17:32 UTC](https://discourse.nodered.org/t/node-red-nodes-and-password/28740 "2020-06-22T17:32:57Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![olab](https://avatars.discourse-cdn.com/v4/letter/o/d07c76/32.png) [@olab](https://discourse.nodered.org/u/olab)\
**Post date:** [22 June 2020 17:32 UTC](https://discourse.nodered.org/t/node-red-nodes-and-password/28740/1 "2020-06-22T17:32:57Z")

</div>

Hi,

There are quite a few different nodes available to conect Note-red to different systems like SQL, Samba, MQTT etc. Most of them need a password to work of course. But, how safe is this passwords actually stored. Are they encrypted in some way? If I run Node Red on a Raspberry PI, would someone with physical access to the RPI, also have access to the configured passwords?

---

<div class="post-metadata">

**Author:** ![zenofmud](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/zenofmud/32/316_2.png) [@zenofmud](https://discourse.nodered.org/u/zenofmud)\
**Post date:** [22 June 2020 18:46 UTC](https://discourse.nodered.org/t/node-red-nodes-and-password/28740/2 "2020-06-22T18:46:46Z")

</div>

No, the password is encrypted and not visable.

---

<div class="post-metadata">

**Author:** ![TotallyInformation](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/totallyinformation/32/31_2.png) [@TotallyInformation](https://discourse.nodered.org/u/TotallyInformation)\
**Post date:** [22 June 2020 19:24 UTC](https://discourse.nodered.org/t/node-red-nodes-and-password/28740/3 "2020-06-22T19:24:34Z")

</div>

To expand on that, assuming that the node is correctly written, credentials are kept in a separate file to your flows. That file is encrypted using a key in your settings.js that you should certainly change.

So if you export a flow from the Editor, the credentials are **not** exported - as you would expect.

If someone gets hold of the credentials file, it is encrypted - but, if they have access to that file, they will also have access to the settings.js file which is in the same folder (your userDir folder, usually `~/.node-red`). The settings file has the key in it so, in theory, the credentials file could be de-encrypted.

The answer to your 2nd question then is _yes_.

But this is no different to any other service you are running that needs access to a secondary service. The credentials have to be somewhere and even if they are encrypted, the key has to be somewhere.

There are various ways to mitigate this issue, here are a few:

- Keep the secure services on a different server, physically and logically separate to your main Node-RED server. So it could be Node-RED on a different device, locked away somewhere. Node-RED has so many ways of interacting with other systems, getting data between two of them is rarely an issue.

- Use a hardware encryption device

- Use a global cloud provider that includes a keystore

Of course, it would be nice if Node-RED could interact with a keystore itself but that is quite complex.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/1X/d073cd938eafa2e558d7c2cd59003b3ef4963033.png) [@system](https://discourse.nodered.org/u/system)\
**Post date:** [21 August 2020 19:24 UTC](https://discourse.nodered.org/t/node-red-nodes-and-password/28740/4 "2020-08-21T19:24:40Z")

</div>

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.