# Node Red security password

**URL:** <https://discourse.nodered.org/t/node-red-security-password/10774>\
**Category:** General\
**Created:** [3 May 2019 12:33 UTC](https://discourse.nodered.org/t/node-red-security-password/10774 "2019-05-03T12:33:31Z")\
**Posts on this page:** 10\
**Page:** 2

<div class="post-metadata">

**Author:** ![raghavendraawad](https://avatars.discourse-cdn.com/v4/letter/r/90db22/32.png) [@raghavendraawad](https://discourse.nodered.org/u/raghavendraawad)\
**Post date:** [4 May 2019 08:43 UTC](https://discourse.nodered.org/t/node-red-security-password/10774/21 "2019-05-04T08:43:33Z")

</div>

> [@Colin](#):
>
> The password is not generated by the hash, you are supposed to enter the password you want in the admin tool and it generates the hash for that password for you to put in the settings file.

this @Colin answer helped me to solve the problem and

also @Andrei suggested to check passwords using hash website given above helped me to check settings.js file password.

---

<div class="post-metadata">

**Author:** ![kumarsemal](https://avatars.discourse-cdn.com/v4/letter/k/7feea3/32.png) [@kumarsemal](https://discourse.nodered.org/u/kumarsemal)\
**Post date:** [14 May 2020 11:00 UTC](https://discourse.nodered.org/t/node-red-security-password/10774/22 "2020-05-14T11:00:45Z")

</div>

I created password using node-red-admin hash-pw and put the generated code in adminAuth password field. I was successfully logged in the editor by the password once. But, after restarting the flow another time from fresh, the editor doesn't seek password. What additional settings should I so that the editor may seek password when i start node-red? Thanks in advance.

---

<div class="post-metadata">

**Author:** ![knolleary](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/knolleary/32/3_2.png) [@knolleary](https://discourse.nodered.org/u/knolleary)\
**Post date:** [14 May 2020 11:03 UTC](https://discourse.nodered.org/t/node-red-security-password/10774/23 "2020-05-14T11:03:50Z")

</div>

Hi @kumarsemal - there is no setting available for the runtime to forget about active logins when it is restarted.

You can force it by deleting the `~/.node-red/.sessions.json` file before restarting NR.

---

<div class="post-metadata">

**Author:** ![khoat0](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/khoat0/32/46207_2.png) [@khoat0](https://discourse.nodered.org/u/khoat0)\
**Post date:** [7 August 2021 19:34 UTC](https://discourse.nodered.org/t/node-red-security-password/10774/24 "2021-08-07T19:34:27Z")

</div>

I really struggled for more than 1 day to find the error of this password.  
I discovered node-red's pw hash generates a different revision through [Online tool to generate and check bcrypt hashed passwords.](https://www.devglan.com/online-tools/bcrypt-hash-generator).  
I have typed the password I want into the terminal as shown in the tutorial image, the system returns a long string of results, I retype it in the settings.js file.  
I changed the 'b' character to the 'a' character to match the revision. After that, I copy the replaced string into the website tool to check the password match again. If matched, then Ctrl + X, Y, Enter. Done.

Thanks for the discussion above and I've discovered more about this for those having the same difficulty as me.

---

<div class="post-metadata">

**Author:** ![Yonny24](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/yonny24/32/49675_2.png) [@Yonny24](https://discourse.nodered.org/u/Yonny24)\
**Post date:** [20 October 2021 14:58 UTC](https://discourse.nodered.org/t/node-red-security-password/10774/25 "2021-10-20T14:58:20Z")

</div>

I'm struggling with this also.

I have nodered running on windows 10.

Updated the settings file, uncommented, ( adminAuth: {}) under C users .nodered.  
Saved, restarted etc.  
My local nodered is not asking for any log in.

Where am I going wrong? Is there another settings file perhaps?

Thanks

---

<div class="post-metadata">

**Author:** ![hardillb](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/hardillb/32/12373_2.png) [@hardillb](https://discourse.nodered.org/u/hardillb)\
**Post date:** [20 October 2021 15:37 UTC](https://discourse.nodered.org/t/node-red-security-password/10774/26 "2021-10-20T15:37:18Z")

</div>

Which file (full path) did you edit

---

<div class="post-metadata">

**Author:** ![Yonny24](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/yonny24/32/49675_2.png) [@Yonny24](https://discourse.nodered.org/u/Yonny24)\
**Post date:** [21 October 2021 17:41 UTC](https://discourse.nodered.org/t/node-red-security-password/10774/27 "2021-10-21T17:41:40Z")

</div>

[info] Settings file : C:\Users\me.node-red\settings.js

---

<div class="post-metadata">

**Author:** ![hardillb](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/hardillb/32/12373_2.png) [@hardillb](https://discourse.nodered.org/u/hardillb)\
**Post date:** [21 October 2021 18:06 UTC](https://discourse.nodered.org/t/node-red-security-password/10774/28 "2021-10-21T18:06:13Z")

</div>

And you have restarted node-red after editing the file?

If so post the changes you've made so we can check the syntax

---

<div class="post-metadata">

**Author:** ![Yonny24](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/yonny24/32/49675_2.png) [@Yonny24](https://discourse.nodered.org/u/Yonny24)\
**Post date:** [21 October 2021 18:13 UTC](https://discourse.nodered.org/t/node-red-security-password/10774/29 "2021-10-21T18:13:28Z")

</div>

yep restarted, rebooted, rechecked. everything done I could think of.

Now if I run 'node-red' from the command line it runs nodered and the credential pops up BUT most nodes are missing and I cannot download anything from the palette.

```auto
    adminAuth: {
       type: "credentials",
       users: [
	   {
           username: "admin",
           password: "$2......",
           permissions: "*"
       },
	    {
           username: "me",
           password: "$......",
           permissions: "*"
       }]
    },

```

---

<div class="post-metadata">

**Author:** ![knolleary](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/knolleary/32/3_2.png) [@knolleary](https://discourse.nodered.org/u/knolleary)\
**Post date:** [21 October 2021 18:21 UTC](https://discourse.nodered.org/t/node-red-security-password/10774/30 "2021-10-21T18:21:25Z")

</div>

Given you have started another thread in this topic, please stick to one or the other.

I suggest you use the other one as this thread is quite old.

[https://discourse.nodered.org/t/adminauth-not-working-windows-10/52521/2](https://discourse.nodered.org/t/adminauth-not-working-windows-10/52521/2)

[Previous page](https://discourse.nodered.org/t/node-red-security-password/10774.md?page=1)