# Node Red security password

**URL:** <https://discourse.nodered.org/t/node-red-security-password/10774>\
**Category:** General\
**Created:** [3 May 2019 12:33 UTC](https://discourse.nodered.org/t/node-red-security-password/10774 "2019-05-03T12:33:31Z")\
**Posts on this page:** 20\
**Page:** 1

<div class="post-metadata">

**Author:** ![raghavendraawad](https://avatars.discourse-cdn.com/v4/letter/r/90db22/32.png) [@raghavendraawad](https://discourse.nodered.org/u/raghavendraawad)\
**Post date:** [3 May 2019 12:33 UTC](https://discourse.nodered.org/t/node-red-security-password/10774/1 "2019-05-03T12:33:31Z")

</div>

Hello,  
I have securely created Username/password based authentication from Node red documentation.  
I am a beginner in node red  
same like this in settings.js file

adminAuth: {  
type: "credentials",  
users: [{  
username: "admin",  
password: "$2a$08$zZWtXTja0fB1pzD4sHCMyOCMYz2Z6dNbM6tl8sJogENOMcxWV9DN.",  
permissions: "\*"  
}]  
}

```auto

but i am not able to log in with the password. 
which password should be used during log in in browser i.e. localhost:...

thanking you.![node%20red|690x309](upload://A8gER88Q9P5NGbZKgLsHlGVzPX7.png)
```

---

<div class="post-metadata">

**Author:** ![Andrei](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/andrei/32/10446_2.png) [@Andrei](https://discourse.nodered.org/u/Andrei)\
**Post date:** [3 May 2019 12:55 UTC](https://discourse.nodered.org/t/node-red-security-password/10774/2 "2019-05-03T12:55:24Z")

</div>

Check if it could be related to one of the below issues:

1- Modifying the wrong `settings.js` file (yep, there is more than one in your system). While Node-RED is initializing it will show in the screen log which settings.js file is used. You should modify that file.

In my case (just to illustrate):

 ![a-02](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/2X/8/86f5e7f7440a1d1c1c123c1be4c250c9434d57a5.png)

2- Make sure you added the configuration lines in the right place in the `settings.js` file. It should be included under the `module.exports` session. To be in the safe side it may be better to search and uncomment the lines from the file.

In my case (just to illustrate):

 ![a-01](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/2X/6/6b962780e5061f4d691e9d204e1c2a83b8579e93.png)

3- It is **mandatory** to restart Node-RED after doing the change to the `settings.js` file

---

<div class="post-metadata">

**Author:** ![raghavendraawad](https://avatars.discourse-cdn.com/v4/letter/r/90db22/32.png) [@raghavendraawad](https://discourse.nodered.org/u/raghavendraawad)\
**Post date:** [3 May 2019 13:04 UTC](https://discourse.nodered.org/t/node-red-security-password/10774/3 "2019-05-03T13:04:53Z")

</div>

thank you for you reply.  
i checked the above given info.  
its all correct. but for log in its not accepting the password given there.  
What password should i use?

---

<div class="post-metadata">

**Author:** ![Andrei](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/andrei/32/10446_2.png) [@Andrei](https://discourse.nodered.org/u/Andrei)\
**Post date:** [3 May 2019 13:09 UTC](https://discourse.nodered.org/t/node-red-security-password/10774/4 "2019-05-03T13:09:55Z")

</div>

> [@raghavendraawad](#):
>
> $2a$08$zZWtXTja0fB1pzD4sHCMyOCMYz2Z6dNbM6tl8sJogENOMcxWV9DN

I recommend to check the password against the hash in an online tools , [like this one (click here):](https://www.devglan.com/online-tools/bcrypt-hash-generator)

If you entered the example from the docs then the password is: password

 ![a-04](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/2X/8/841919444e2a8d9b18b80d03d2bf13b0db4c2353.png)

---

<div class="post-metadata">

**Author:** ![ukmoose](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/ukmoose/32/13_2.png) [@ukmoose](https://discourse.nodered.org/u/ukmoose)\
**Post date:** [3 May 2019 13:12 UTC](https://discourse.nodered.org/t/node-red-security-password/10774/5 "2019-05-03T13:12:54Z")

</div>

You need to follow the link to the security.html page and follow the instructions to create your own password hash that replaces the `"$2a$08$zZWtXTja0fB1pzD4sHCMyOCMYz2Z6dNbM6tl8sJogENOMcxWV9DN."`

you then restart Node-RED so it reads the file containing your password hash and log in with your password.

---

<div class="post-metadata">

**Author:** ![raghavendraawad](https://avatars.discourse-cdn.com/v4/letter/r/90db22/32.png) [@raghavendraawad](https://discourse.nodered.org/u/raghavendraawad)\
**Post date:** [3 May 2019 13:46 UTC](https://discourse.nodered.org/t/node-red-security-password/10774/6 "2019-05-03T13:46:58Z")

</div>

thank you for you reply. i followed all these steps.  
"$2b$08$gzkXWJA3Zd2RzpXqL7uPsOqyHsF628QCF9CYHCywVcz3Gqe56N4ta.",  
this is what my password in settings.js file looks like.  
but with this i am not able to login.

---

<div class="post-metadata">

**Author:** ![Steve-Mcl](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/steve-mcl/32/4826_2.png) [@Steve-Mcl](https://discourse.nodered.org/u/Steve-Mcl)\
**Post date:** [3 May 2019 14:01 UTC](https://discourse.nodered.org/t/node-red-security-password/10774/7 "2019-05-03T14:01:10Z")

</div>

Did you check your password like suggested?

> [@Andrei](#):
>
> I recommend to check the password against the hash in an online tools , [like this one (click here):](https://www.devglan.com/online-tools/bcrypt-hash-generator)

---

<div class="post-metadata">

**Author:** ![raghavendraawad](https://avatars.discourse-cdn.com/v4/letter/r/90db22/32.png) [@raghavendraawad](https://discourse.nodered.org/u/raghavendraawad)\
**Post date:** [3 May 2019 14:06 UTC](https://discourse.nodered.org/t/node-red-security-password/10774/8 "2019-05-03T14:06:46Z")

</div>

I tried this Hash match.  
but still i dont know passwords to match.  
so this kind of not working for me.

---

<div class="post-metadata">

**Author:** ![Steve-Mcl](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/steve-mcl/32/4826_2.png) [@Steve-Mcl](https://discourse.nodered.org/u/Steve-Mcl)\
**Post date:** [3 May 2019 14:10 UTC](https://discourse.nodered.org/t/node-red-security-password/10774/9 "2019-05-03T14:10:40Z")

</div>

Eh?

Did you generate your own password? If so, then you know it.

1. Think of a password
2. Generate a hash from that password
3. Check hash matches your password
4. Copy the hash to settings file
5. Restart node red
6. Login using password you thought of in step 1

It's really quite simple.

---

<div class="post-metadata">

**Author:** ![Andrei](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/andrei/32/10446_2.png) [@Andrei](https://discourse.nodered.org/u/Andrei)\
**Post date:** [3 May 2019 14:18 UTC](https://discourse.nodered.org/t/node-red-security-password/10774/10 "2019-05-03T14:18:03Z")

</div>

If you follow the step by step instructions from @Steve-Mcl it is gonna work wonderfully.

Just one question:  
What tool you have used to get the hash you posted?  
"$2b$08$gzkXWJA3Zd2RzpXqL7uPsOqyHsF628QCF9CYHCywVcz3Gqe56N4ta." ?

---

<div class="post-metadata">

**Author:** ![raghavendraawad](https://avatars.discourse-cdn.com/v4/letter/r/90db22/32.png) [@raghavendraawad](https://discourse.nodered.org/u/raghavendraawad)\
**Post date:** [3 May 2019 15:06 UTC](https://discourse.nodered.org/t/node-red-security-password/10774/11 "2019-05-03T15:06:45Z")

</div>

i installed first

> npm install -g node-red-admin

then

> node-red-admin hash-pw

```auto
in command promt 

this created password. and i copied it and pasted into setttings.js file in node-red.

and then i used it to log in into node red. 
but not working.
```

---

<div class="post-metadata">

**Author:** ![ukmoose](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/ukmoose/32/13_2.png) [@ukmoose](https://discourse.nodered.org/u/ukmoose)\
**Post date:** [3 May 2019 15:09 UTC](https://discourse.nodered.org/t/node-red-security-password/10774/12 "2019-05-03T15:09:08Z")

</div>

you don't mention restarting Node-RED

---

<div class="post-metadata">

**Author:** ![raghavendraawad](https://avatars.discourse-cdn.com/v4/letter/r/90db22/32.png) [@raghavendraawad](https://discourse.nodered.org/u/raghavendraawad)\
**Post date:** [3 May 2019 15:12 UTC](https://discourse.nodered.org/t/node-red-security-password/10774/13 "2019-05-03T15:12:05Z")

</div>

I did restarted and did process newly again.

this is what i followed: from Node Red Documentation

> Blockquote

#### Username/password based authentication

To enable user authentication on the Editor and Admin API, add the following to your `settings.js` file:

```auto
adminAuth: {
    type: "credentials",
    users: [{
        username: "admin",
        password: "$2a$08$zZWtXTja0fB1pzD4sHCMyOCMYz2Z6dNbM6tl8sJogENOMcxWV9DN.",
        permissions: "*"
    }]
}

```

The `users` property is an array of user objects. This allows you to define multiple users, each of whom can have different permissions.

This example configuration defines a single user called `admin` who has permission to do everything within the editor and has a password of `password` . Note that the password is securely hashed using the bcrypt algorithm.

_Note_ : in previous releases of Node-RED, the setting `httpAdminAuth` could be used to enable HTTP Basic Authentication on the editor. This option is deprecated and should not be used.

##### Generating the password hash

To generate a suitable password hash, you can use the `node-red-admin` command-line tool. Instructions for installing the tool are available [here](https://nodered.org/docs/node-red-admin).

```auto
node-red-admin hash-pw

```

The tool will prompt you for the password you wish to use and then print out the hash that can be copied into the settings file.

---

<div class="post-metadata">

**Author:** ![Colin](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/colin/32/17040_2.png) [@Colin](https://discourse.nodered.org/u/Colin)\
**Post date:** [3 May 2019 15:40 UTC](https://discourse.nodered.org/t/node-red-security-password/10774/14 "2019-05-03T15:40:17Z")

</div>

Which settings.json file did you edit?  
Post the log you see when you restart node-red, starting with the Welcome to node-red message, up to the point where you try to log in.

---

<div class="post-metadata">

**Author:** ![raghavendraawad](https://avatars.discourse-cdn.com/v4/letter/r/90db22/32.png) [@raghavendraawad](https://discourse.nodered.org/u/raghavendraawad)\
**Post date:** [3 May 2019 15:46 UTC](https://discourse.nodered.org/t/node-red-security-password/10774/15 "2019-05-03T15:46:17Z")

</div>

![325](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/2X/7/79fde479d54a09efb7f882d895ed535e944eb682.png) ![node%20red%20command](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/2X/f/fca4b11f1fa0ef2f3b8a8db7bc7c0d6bce7d984d.png)

please checkout the images i have uploaded..  
thanking you .  
i just dont know which password should i use while logging in Node red...

Thanking you.

---

<div class="post-metadata">

**Author:** ![Andrei](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/andrei/32/10446_2.png) [@Andrei](https://discourse.nodered.org/u/Andrei)\
**Post date:** [3 May 2019 15:55 UTC](https://discourse.nodered.org/t/node-red-security-password/10774/16 "2019-05-03T15:55:22Z")

</div>

> [@raghavendraawad](#):
>
> i just dont know which password should i use while logging in Node red...

`

The password you have to enter in the login screen is the one you entered when using the tool `node-red-admin

![a-05](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/2X/4/4f32609f7cadf2db47616f0b8d65877b20c3135a.png)

One thing you can test is trying to login using another browser in your computer to see if it makes any difference.

---

<div class="post-metadata">

**Author:** ![raghavendraawad](https://avatars.discourse-cdn.com/v4/letter/r/90db22/32.png) [@raghavendraawad](https://discourse.nodered.org/u/raghavendraawad)\
**Post date:** [3 May 2019 16:08 UTC](https://discourse.nodered.org/t/node-red-security-password/10774/17 "2019-05-03T16:08:47Z")

</div>

Thank you for all your help.  
I got the point about the password generated by hash.  
so I used the Hash password which converts it into a simple password.

now I am able to log in.

thanking you.

regards,  
Ragahvendraawad.

---

<div class="post-metadata">

**Author:** ![Colin](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/colin/32/17040_2.png) [@Colin](https://discourse.nodered.org/u/Colin)\
**Post date:** [3 May 2019 21:03 UTC](https://discourse.nodered.org/t/node-red-security-password/10774/18 "2019-05-03T21:03:14Z")

</div>

The password is not generated by the hash, you are supposed to enter the password you want in the admin tool and it generates the hash for that password for you to put in the settings file.

---

<div class="post-metadata">

**Author:** ![raghavendraawad](https://avatars.discourse-cdn.com/v4/letter/r/90db22/32.png) [@raghavendraawad](https://discourse.nodered.org/u/raghavendraawad)\
**Post date:** [4 May 2019 08:27 UTC](https://discourse.nodered.org/t/node-red-security-password/10774/19 "2019-05-04T08:27:51Z")

</div>

ahha.  
thank you @Colin, @Andrei, @ukmoose .  
I solved that problem thank you all.

these posts helped me in my current problem as well as other aspects of node red.

thanking you.

---

<div class="post-metadata">

**Author:** ![ukmoose](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/ukmoose/32/13_2.png) [@ukmoose](https://discourse.nodered.org/u/ukmoose)\
**Post date:** [4 May 2019 08:37 UTC](https://discourse.nodered.org/t/node-red-security-password/10774/20 "2019-05-04T08:37:12Z")

</div>

What was your problem and how did you solve it?

This answer would make the thread more useful for anyone else who has the same problem and find this thread in the future.

[Next page](https://discourse.nodered.org/t/node-red-security-password/10774.md?page=2)