How do I create the correct password hash for Z-Wave JS UI?

I am trying to set a new, strong password for the GUI in Z-Wafe JS UI, but I can’t find anything about it in the documentation. And when I try to ceate a password has in for instance openssl on the Pi, it doesn’t work at all. The password hash for the standard user/password (admin/zwave) is several times as long as what I get from OpenSSL (or from hashing in Node-RED) or any of several online hash generators. What should use to get this working?

I mean, just put your Title into AI search, and got the below
(and followed up asking about password complexity) :rofl:

The Z-Wave JS UI application does not allow users to manually create or input password hashes. The system automatically handles password security by hashing and salting credentials when a user sets or changes their password through the interface.

Z-Wave JS UI does not enforce any password complexity requirements. There is no minimum length, no requirement for special characters, uppercase letters, or numbers. You can set any password you choose through the UI (lock icon → change password), and it will be stored as a bcrypt hash with a salt.

The only implicit “rule” is that when changing your password, the new one must differ from the current one. The default password (zwave) itself is a single lowercase word, which confirms no complexity policy is in place.

If you want to follow best practices, use a long passphrase or generated password, but the application won’t reject anything less

To set a password, you must use the built-in UI features:

  • First-Time Setup: The default credentials are typically admin / zwave.

  • Changing Password: Log into the web interface, click the lock icon in the top bar, and follow the dialog prompts to set a new password. The system will generate the necessary hash automatically.

If you have forgotten your password and cannot log in to change it, you can manually disable authentication by editing the settings.json file (where the Z-Wave JS UI configuration is stored) and changing "authEnabled":true to "authEnabled":false, then restarting the service. This bypasses the need for a password hash entirely.

1 Like

Thanks! Done. First time an AI says something that a regular search doesn’t. I tried to google variations of "z-wave js ui" "change password" and got zip. So I guess our new AI overlords are one step ahead.

Excellent, glad its working.
Yes AI is problematic for AI companies scraping everyone elses work for free.
Privacy of cloud hosted files and data, and other peoples code training their AI.

But I have to say, using it for research and helping with code snippets and config problems is really useful.

search.brave.com is the most convenient I’ve found. Duck.AI has lots of options of LLMs to chose from but often gives weird results.

Anyway, glad your working :slight_smile: :+1:

Honestly I won’t touch AI, maybe not for years, maybe not for the rest of my life (and judging from the longevity in my family, that’s around 40 years when I’m 60 now).

The reason is that I am about to loose my job to AI, either later this year or next year, along with probably around 100 of my colleagues, a job I have had for 35 years. If I had kept it for two more years I could have retired with a lower pension, but still liveable. At 60 I’m not really in demand in a corporate world for a new line of work, and translation will die as a human occupation, except for poetry and high class novels within a few years anyway.

So we will have to live on my wife’s wages until I’m 62. We’re in the process of selling our house now, we won’t be able to keep it and don’t want to do it in the last minute, which is the reason I needed to change the password in the first place. I want the smart house to be secure when I deliver it to the buyer.

This AI system does my job a lot cheaper than me, but with significantly lower quality (which the company redily admits). But they don’t care because the clients don’t understand enough about the quality they are buying (it’s a rather advanced, technical translation service) to complain. And the end users are not complaining in large enough numbers for the clients to care.

And now my assigned rant space for today is spent. :joy:

LOL, its all good.
As a fellow ancient, I empathise and completely relate to the AI resentment. :grinning_face_with_smiling_eyes:

1 Like