Home Assistant token secrets in cleartext
Original title: Home Assistant: the password is not the key — token secrets in cleartext, two token classes never expire, password change revokes none (2026.11.0, live-proven)
Token secrets remain unexpired after password changes and are stored in cleartext.
Home Assistant stores token secrets in cleartext despite recommending strong passwords. Two token classes never expire. Changing the password does not revoke any tokens. The issue was tested in home-assistant/core 2026.11.0 and is live-proven.
- Token secrets stored in cleartext
- Two token classes never expire
- Password change revokes none
- Tested in 2026.11.0
Impact: Exposure of token secrets in cleartext
- Vendors
- Home Assistant
From the original article
Posted by theknell on Nov 08 Home Assistant's documentation tells users: "Your password is the key to your home, so choose a strong, unique one." Home Assistant is installed in two million homes by the vendor's own published count, and in those homes it holds the locks, the alarm, the garage, the cameras, and the record of who is home. The password is not the key.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.