# Securing Node-Red without command line

**URL:** <https://discourse.nodered.org/t/securing-node-red-without-command-line/82346>\
**Category:** General\
**Tags:** security\
**Created:** [26 October 2023 06:00 UTC](https://discourse.nodered.org/t/securing-node-red-without-command-line/82346 "2023-10-26T06:00:03Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![nygma2004](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/nygma2004/32/1308_2.png) [@nygma2004](https://discourse.nodered.org/u/nygma2004)\
**Post date:** [26 October 2023 06:00 UTC](https://discourse.nodered.org/t/securing-node-red-without-command-line/82346/1 "2023-10-26T06:00:03Z")

</div>

Besides my main Node-Red server, I am also playing around with Node-Red on a Sonoff iHost. My question about securing Node-Red: how can I generate a password hash to configure the `adminAuth` section, if I don't have a command line to run `node-red admin hash-pw`.  
Do you have any ideas?

---

<div class="post-metadata">

**Author:** ![marcus-j-davies](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/marcus-j-davies/32/103435_2.png) [@marcus-j-davies](https://discourse.nodered.org/u/marcus-j-davies)\
**Post date:** [26 October 2023 06:21 UTC](https://discourse.nodered.org/t/securing-node-red-without-command-line/82346/2 "2023-10-26T06:21:36Z")

</div>

Hi @nygma2004  
Can you make changes to the settings file at all?

The password hash uses `bcrypt`

---

<div class="post-metadata">

**Author:** ![nygma2004](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/nygma2004/32/1308_2.png) [@nygma2004](https://discourse.nodered.org/u/nygma2004)\
**Post date:** [26 October 2023 07:32 UTC](https://discourse.nodered.org/t/securing-node-red-without-command-line/82346/3 "2023-10-26T07:32:32Z")

</div>

> [@marcus-j-davies](#):
>
> Hi @nygma2004  
> Can you make changes to the settings file at all?

Yes, they have created a File Manager plug-in, which allows you to view the filesystem in each docker image. Even has a built in web editor, so it makes it super easy to make changes to the settings.js.

---

<div class="post-metadata">

**Author:** ![marcus-j-davies](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/marcus-j-davies/32/103435_2.png) [@marcus-j-davies](https://discourse.nodered.org/u/marcus-j-davies)\
**Post date:** [26 October 2023 07:49 UTC](https://discourse.nodered.org/t/securing-node-red-without-command-line/82346/4 "2023-10-26T07:49:34Z")

</div>

You should be able to generate a `bcrypt` hash offline/online easily enough .

Just be careful using online generators - whilst mostly safe, feel I should hand out that caution 😁

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/1X/d073cd938eafa2e558d7c2cd59003b3ef4963033.png) [@system](https://discourse.nodered.org/u/system)\
**Post date:** [25 December 2023 07:50 UTC](https://discourse.nodered.org/t/securing-node-red-without-command-line/82346/5 "2023-12-25T07:50:18Z")

</div>

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.