Local password management
Local passwords support bcrypt and Argon2id in caddy-security v1.3.0 / go-authcrunch v1.3.8. A federated user changes their password at their identity provider; signing into the portal does not grant control of a local account.
Choose the password operation
Hash generation, password replacement, and recovery are different operations with different authority.
| Task | Interface | Expected outcome |
|---|---|---|
| Generate bcrypt or Argon2id import material | Offline released password utility | A directive; no account is changed |
| Change your own current password | Local Profile with live session and current proof | Account mutation; verify new login and old credential rejection |
| Replace another account’s password | Enabled administrative API or compatible management client | Explicit admin mutation of the selected account |
| Recover a forgotten password | Your administrator-assisted process | The released recovery view is not a complete reset-link service |
Manually
Use the released executable's password utility. It prompts without terminal echo:
authcrunch security local generate password hash
authcrunch security local generate password hash --algorithm argon2
Bcrypt is the default, cost 10. Argon2 selects Argon2id; defaults are 65536 KiB,
three iterations and four lanes. The output is a quoted Caddyfile password
directive, ready for static-user provisioning. Review
resource use before changing cost parameters; --cost is bcrypt-only.
For automation, --password-file /private/password.txt requires an owner-only
file, or --password-file - reads stdin. One final LF/CRLF is removed; other
whitespace is preserved. --db-path reads the existing password policy without
modifying the database. Do not put a production password on a command line.
A compatible standalone CLI can be installed at the matching version:
go install github.com/greenpau/go-authcrunch/cmd/authdbctl@v1.3.8
Its released command guide
explains server configuration and updates. Do not assume installing @latest
changes the library inside a previously built Caddy server.
Prefer a supported account mutation over replacing a JSON hash by hand. Manual file repair requires a stopped writer and coherent backup; it must preserve algorithm and security metadata. A password change invalidates prior credential evidence, so verify a fresh login and old refresh/OIDC credential rejection.
Settings Page
For a local account with authp/user or authp/admin, sign in and open
/auth/profile/, then choose password management. A live completed portal session
is required. The old /auth/settings route is not available in this release.
- Confirm the selected local account and enter the current password.
- Enter and confirm a new password that satisfies the store's policy.
- Submit the change and sign in again with the new credential.
- Verify that the old password fails and required MFA still applies.
Password-change sequence captured in March 2026
/auth/profile/ directly.
The released recovery endpoint does not provide a complete forgotten-password service. Establish an administrator-assisted recovery process rather than promising reset links that the implementation cannot complete.
Agentic Prompts
Copy a prompt into your LLM to explore this topic. Each prompt prioritizes upstream repository guidance and code over this page, and asks for version-aware reasoning.
Compare bcrypt and Argon2id
Help me understand Local password management.
Primary authorities (take precedence over website documentation):
https://github.com/greenpau/caddy-security/blob/main/AGENTS.md
https://github.com/greenpau/caddy-security/tree/main/.codex/skills
https://github.com/greenpau/go-authcrunch/blob/main/AGENTS.md
https://github.com/greenpau/go-authcrunch/tree/main/.codex/skills
Read each repository's root AGENTS.md first, then any scoped AGENTS.md that
applies to inspected paths. Read the relevant SKILL.md files and follow their
implementation and test references.
Relevant skills to locate: local-password-authentication, configuration-users,
authentication-portal-profile.
Secondary reference:
https://docs.authcrunch.com/docs/authenticate/local/password-management
If a source is inaccessible, ask me to paste its relevant text. Identify the
versions your answer applies to; main may be newer than my release. Resolve
disagreements using code and tests, and flag unverified claims. Use synthetic
credentials and redacted examples; explain proposed checks before any changes.
Explain the released password utility’s algorithms, cost/resource settings,
and generated Caddyfile directive. Separate hashing from encryption and from a
JSON credential record. Ask which installed utility/version I use before
recommending parameters.
Understand private input handling
Help me understand Local password management.
Primary authorities (take precedence over website documentation):
https://github.com/greenpau/caddy-security/blob/main/AGENTS.md
https://github.com/greenpau/caddy-security/tree/main/.codex/skills
https://github.com/greenpau/go-authcrunch/blob/main/AGENTS.md
https://github.com/greenpau/go-authcrunch/tree/main/.codex/skills
Read each repository's root AGENTS.md first, then any scoped AGENTS.md that
applies to inspected paths. Read the relevant SKILL.md files and follow their
implementation and test references.
Relevant skills to locate: local-password-authentication, configuration-users,
authentication-portal-profile.
Secondary reference:
https://docs.authcrunch.com/docs/authenticate/local/password-management
If a source is inaccessible, ask me to paste its relevant text. Identify the
versions your answer applies to; main may be newer than my release. Resolve
disagreements using code and tests, and flag unverified claims. Use synthetic
credentials and redacted examples; explain proposed checks before any changes.
Walk through interactive terminal input, owner-only password file, and stdin
without running commands. Explain newline removal, preserved whitespace,
--db-path policy reading, and why a production password must not appear on a
command line or in shell history.
Compare self-service and administration
Help me understand Local password management.
Primary authorities (take precedence over website documentation):
https://github.com/greenpau/caddy-security/blob/main/AGENTS.md
https://github.com/greenpau/caddy-security/tree/main/.codex/skills
https://github.com/greenpau/go-authcrunch/blob/main/AGENTS.md
https://github.com/greenpau/go-authcrunch/tree/main/.codex/skills
Read each repository's root AGENTS.md first, then any scoped AGENTS.md that
applies to inspected paths. Read the relevant SKILL.md files and follow their
implementation and test references.
Relevant skills to locate: local-password-authentication, configuration-users,
authentication-portal-profile.
Secondary reference:
https://docs.authcrunch.com/docs/authenticate/local/password-management
If a source is inaccessible, ask me to paste its relevant text. Identify the
versions your answer applies to; main may be newer than my release. Resolve
disagreements using code and tests, and flag unverified claims. Use synthetic
credentials and redacted examples; explain proposed checks before any changes.
Explain a current local Profile password change versus administrator
credential provisioning/reset. Include current-password verification,
local/live-session requirements, policy enforcement, and fresh login. Keep
federated password changes at the identity source.
Diagnose a rejected password
Help me understand Local password management.
Primary authorities (take precedence over website documentation):
https://github.com/greenpau/caddy-security/blob/main/AGENTS.md
https://github.com/greenpau/caddy-security/tree/main/.codex/skills
https://github.com/greenpau/go-authcrunch/blob/main/AGENTS.md
https://github.com/greenpau/go-authcrunch/tree/main/.codex/skills
Read each repository's root AGENTS.md first, then any scoped AGENTS.md that
applies to inspected paths. Read the relevant SKILL.md files and follow their
implementation and test references.
Relevant skills to locate: local-password-authentication, configuration-users,
authentication-portal-profile.
Secondary reference:
https://docs.authcrunch.com/docs/authenticate/local/password-management
If a source is inaccessible, ask me to paste its relevant text. Identify the
versions your answer applies to; main may be newer than my release. Resolve
disagreements using code and tests, and flag unverified claims. Use synthetic
credentials and redacted examples; explain proposed checks before any changes.
Help me investigate wrong old password, surrounding-whitespace differences,
hash-format mismatch, password policy, unsupported cost flags, or old Settings
links. Ask for redacted errors and metadata. Never ask for the actual password
or manually alter textual hash parameters to rehash it.
Plan credential-change regression
Help me understand Local password management.
Primary authorities (take precedence over website documentation):
https://github.com/greenpau/caddy-security/blob/main/AGENTS.md
https://github.com/greenpau/caddy-security/tree/main/.codex/skills
https://github.com/greenpau/go-authcrunch/blob/main/AGENTS.md
https://github.com/greenpau/go-authcrunch/tree/main/.codex/skills
Read each repository's root AGENTS.md first, then any scoped AGENTS.md that
applies to inspected paths. Read the relevant SKILL.md files and follow their
implementation and test references.
Relevant skills to locate: local-password-authentication, configuration-users,
authentication-portal-profile.
Secondary reference:
https://docs.authcrunch.com/docs/authenticate/local/password-management
If a source is inaccessible, ask me to paste its relevant text. Identify the
versions your answer applies to; main may be newer than my release. Resolve
disagreements using code and tests, and flag unverified claims. Use synthetic
credentials and redacted examples; explain proposed checks before any changes.
Design a disposable-user test for new-password success, old-password denial,
MFA persistence, and refresh/OIDC evidence invalidation. Explain supported
mutation versus offline stopped-writer repair and the absence of a complete
released forgotten-password workflow.
Source Code References
Start with the code search, then follow the parser, runtime, and tests relevant
to this topic. These links target main; use GitHub's branch/tag selector to
compare them with your installed release.
- Search this topic in both repositories — searches topic-specific symbols and paths across both codebases.
- caddy-security: command_credentials.go — implements offline password-hash and API-key generation.
- caddy-security: command_credentials_test.go — tests credential-generation flags, input, and output handling.
- go-authcrunch: pkg/identity/password.go — defines password records and hash handling.
- go-authcrunch: pkg/identity/password_argon2.go — implements bounded Argon2id password-hash handling.
- go-authcrunch: pkg/authn/api_update_user_password.go — validates and applies a signed-in local user’s password change.
- go-authcrunch: pkg/identity/password_argon2_test.go — tests Argon2id hashing, verification, and rejected inputs.