# Where are the security data save

**URL:** <https://discourse.nodered.org/t/where-are-the-security-data-save/12888>\
**Category:** General\
**Created:** [4 July 2019 06:32 UTC](https://discourse.nodered.org/t/where-are-the-security-data-save/12888 "2019-07-04T06:32:18Z")\
**Posts on this page:** 17\
**Page:** 1

<div class="post-metadata">

**Author:** ![Jack](https://avatars.discourse-cdn.com/v4/letter/j/cc9497/32.png) [@Jack](https://discourse.nodered.org/u/Jack)\
**Post date:** [4 July 2019 06:32 UTC](https://discourse.nodered.org/t/where-are-the-security-data-save/12888/1 "2019-07-04T06:32:18Z")

</div>

sorry for my bad English,I want to know Where is the verification information storen,for example:mqtt node,I find the broker data in flows.json about port,clientId...but I can't find security of username&password in any file in local,I've checked everything I can think of. have some one can tell me which file stone the security data.

---

<div class="post-metadata">

**Author:** ![bakman2](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/bakman2/32/6207_2.png) [@bakman2](https://discourse.nodered.org/u/bakman2)\
**Post date:** [4 July 2019 06:44 UTC](https://discourse.nodered.org/t/where-are-the-security-data-save/12888/2 "2019-07-04T06:44:43Z")

</div>

it is in `flows_cred.json`

---

<div class="post-metadata">

**Author:** ![Jack](https://avatars.discourse-cdn.com/v4/letter/j/cc9497/32.png) [@Jack](https://discourse.nodered.org/u/Jack)\
**Post date:** [4 July 2019 07:02 UTC](https://discourse.nodered.org/t/where-are-the-security-data-save/12888/3 "2019-07-04T07:02:59Z")

</div>

thank you your reply,I open the flows\_cred.json and found the data is:"{  
"$":"560dccc0a08e138a8ff84ba8aaf95ca2M43oB99VDahLalxsSVKFpaMVBkE5T0d2DNTk8RxVyqOV3QV/4F0p9PnTS/OT+LP5NJfiQ4Dy8WrL1+KT3oQ8fAs3rhXN1yOpw+1IINpMn+zOUIEav2UBvrEPfP8NYxAYSpjOnDbS2UduicW6pQRWT63vRmlI4gcBC5X9A/mte+a9vkims9KQ+UmBkLYOEIa5bkoxfKAhmaJmRnu+fZzUTtZSHUMkfNsVMJtuclKNlEMg+0JGZplRTvbijsr6hgeYr6MOTGwXy8sONBskQ36iYrL7kRoZAOqjECro2raznNdJFrUngTpLpx5nkmIAkp4ZMVzLzYW3CCEcKhWAz1WQ7ha6zA35uW8Cwc6uFR0RDVlrswf5YelgB8VVGoX=="  
}"  
So, username and password information is look like encrypted saved, do you know what algorithm is used for encryption?

---

<div class="post-metadata">

**Author:** ![bakman2](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/bakman2/32/6207_2.png) [@bakman2](https://discourse.nodered.org/u/bakman2)\
**Post date:** [4 July 2019 07:17 UTC](https://discourse.nodered.org/t/where-are-the-security-data-save/12888/4 "2019-07-04T07:17:18Z")

</div>

Did you follow the steps to secure node-red ?

[https://nodered.org/docs/user-guide/runtime/securing-node-red](https://nodered.org/docs/user-guide/runtime/securing-node-red)

---

<div class="post-metadata">

**Author:** ![Jack](https://avatars.discourse-cdn.com/v4/letter/j/cc9497/32.png) [@Jack](https://discourse.nodered.org/u/Jack)\
**Post date:** [4 July 2019 07:26 UTC](https://discourse.nodered.org/t/where-are-the-security-data-save/12888/5 "2019-07-04T07:26:32Z")

</div>

I had follow the steps to secure node-red for login node-red,but what does node-red's permission have to do with node's verification information?

---

<div class="post-metadata">

**Author:** ![bakman2](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/bakman2/32/6207_2.png) [@bakman2](https://discourse.nodered.org/u/bakman2)\
**Post date:** [4 July 2019 07:30 UTC](https://discourse.nodered.org/t/where-are-the-security-data-save/12888/6 "2019-07-04T07:30:11Z")

</div>

When you start node-red do you see this on the command line?

```auto
Your flow credentials file is encrypted using a system-generated key.

If the system-generated key is lost for any reason, your credentials
file will not be recoverable, you will have to delete it and re-enter
your credentials.

You should set your own key using the 'credentialSecret' option in
your settings file. Node-RED will then re-encrypt your credentials
file using your chosen key the next time you deploy a change.

```

---

<div class="post-metadata">

**Author:** ![Jack](https://avatars.discourse-cdn.com/v4/letter/j/cc9497/32.png) [@Jack](https://discourse.nodered.org/u/Jack)\
**Post date:** [4 July 2019 07:43 UTC](https://discourse.nodered.org/t/where-are-the-security-data-save/12888/7 "2019-07-04T07:43:02Z")

</div>

Yes, exactly the same.

---

<div class="post-metadata">

**Author:** ![bakman2](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/bakman2/32/6207_2.png) [@bakman2](https://discourse.nodered.org/u/bakman2)\
**Post date:** [4 July 2019 07:44 UTC](https://discourse.nodered.org/t/where-are-the-security-data-save/12888/8 "2019-07-04T07:44:55Z")

</div>

That is why your `flows_cred.json` is encrypted.

You can edit the `settings.js` file and either set `credentialSecret : false,` or set an encrypted password.  
Restart node-red when done.

Read the `settings.js` file for more details.

---

<div class="post-metadata">

**Author:** ![Colin](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/colin/32/17040_2.png) [@Colin](https://discourse.nodered.org/u/Colin)\
**Post date:** [4 July 2019 07:48 UTC](https://discourse.nodered.org/t/where-are-the-security-data-save/12888/9 "2019-07-04T07:48:17Z")

</div>

@Jack perhaps if you explained what you are trying to achieve you may get more help with whatever you are trying to do.

---

<div class="post-metadata">

**Author:** ![Jack](https://avatars.discourse-cdn.com/v4/letter/j/cc9497/32.png) [@Jack](https://discourse.nodered.org/u/Jack)\
**Post date:** [4 July 2019 07:54 UTC](https://discourse.nodered.org/t/where-are-the-security-data-save/12888/10 "2019-07-04T07:54:56Z")

</div>

Wow, you are right, thank you every much. when I set "credentialSecret : false" and restart node-red,it is success!

---

<div class="post-metadata">

**Author:** ![Jack](https://avatars.discourse-cdn.com/v4/letter/j/cc9497/32.png) [@Jack](https://discourse.nodered.org/u/Jack)\
**Post date:** [4 July 2019 08:03 UTC](https://discourse.nodered.org/t/where-are-the-security-data-save/12888/11 "2019-07-04T08:03:49Z")

</div>

I want to dynamically modify the configuration information of the node, mainly mqtt, mysql, influxdb and others, so I looking for storage location, and now i had found config broker in flows.json and security data in flows\_cred.json, my node-red has hundreds of processes, i don;t want to manually configure, i hope to write configuration with code

---

<div class="post-metadata">

**Author:** ![bakman2](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/bakman2/32/6207_2.png) [@bakman2](https://discourse.nodered.org/u/bakman2)\
**Post date:** [4 July 2019 08:26 UTC](https://discourse.nodered.org/t/where-are-the-security-data-save/12888/12 "2019-07-04T08:26:49Z")

</div>

You can have multiple instances of nodes each with its own credentials (?).

---

<div class="post-metadata">

**Author:** ![knolleary](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/knolleary/32/3_2.png) [@knolleary](https://discourse.nodered.org/u/knolleary)\
**Post date:** [4 July 2019 08:29 UTC](https://discourse.nodered.org/t/where-are-the-security-data-save/12888/13 "2019-07-04T08:29:38Z")

</div>

@Jack you cannot dynamically change the properties without restarting Node-RED. That is the only way to get the runtime to reload the flow configuration and pickup any changes you may have made.

You can also use environment variables in your flow configuration so you don't have to edit the flow file - [https://nodered.org/docs/user-guide/environment-variables](https://nodered.org/docs/user-guide/environment-variables)

---

<div class="post-metadata">

**Author:** ![Jack](https://avatars.discourse-cdn.com/v4/letter/j/cc9497/32.png) [@Jack](https://discourse.nodered.org/u/Jack)\
**Post date:** [4 July 2019 11:21 UTC](https://discourse.nodered.org/t/where-are-the-security-data-save/12888/14 "2019-07-04T11:21:12Z")

</div>

so,if I want to config mqtt broker's data(broker,port,clientId,username,password),how can I do use environment variables,thank you in advance.

---

<div class="post-metadata">

**Author:** ![Jack](https://avatars.discourse-cdn.com/v4/letter/j/cc9497/32.png) [@Jack](https://discourse.nodered.org/u/Jack)\
**Post date:** [4 July 2019 11:26 UTC](https://discourse.nodered.org/t/where-are-the-security-data-save/12888/15 "2019-07-04T11:26:35Z")

</div>

My flows are use for pub data on mqtt,One process per device,i have 100+ device,every device have own clientId,username,password(by Equipment certification)

---

<div class="post-metadata">

**Author:** ![ukmoose](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/ukmoose/32/13_2.png) [@ukmoose](https://discourse.nodered.org/u/ukmoose)\
**Post date:** [4 July 2019 11:41 UTC](https://discourse.nodered.org/t/where-are-the-security-data-save/12888/16 "2019-07-04T11:41:31Z")

</div>

I'm confused as to what you are doing.

Are you talking about:

1. linking Node-RED to 100 MQTT brokers?
2. Having Node-RED installed on 100 devices?
3. something else.

---

<div class="post-metadata">

**Author:** ![Jack](https://avatars.discourse-cdn.com/v4/letter/j/cc9497/32.png) [@Jack](https://discourse.nodered.org/u/Jack)\
**Post date:** [6 July 2019 08:23 UTC](https://discourse.nodered.org/t/where-are-the-security-data-save/12888/17 "2019-07-06T08:23:44Z")

</div>

to find a way to dynamic set the mqtt broker(do not enter manually)