From 18d5a40d32262f90b65a2b25a0e67d3ce0f6190e Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Sun, 26 Apr 2026 20:04:00 +0000
Subject: [PATCH] Use interactive password prompt for argon2 hash generation

The bootstrap and add-user docs passed --password 'plaintext' on the
docker compose run command line, leaking the plaintext into shell
history (~/.bash_history, ~/.zsh_history) and the process list
(ps aux). Switched all three call sites to the interactive form
(no --password flag), which makes Authelia prompt for the password
and a confirmation without echoing.

Affected:
- README.md "Create your first user" step
- README.md "Add a user" section
- authelia/users_database.yml.example header comment

https://claude.ai/code/session_013XZ1vmgk78k2PEQ5DmJhF3
---
 README.md                           | 13 +++++++++----
 authelia/users_database.yml.example | 10 +++++++---
 2 files changed, 16 insertions(+), 7 deletions(-)

diff --git a/README.md b/README.md
index 9de1d1a..e2812bb 100644
--- a/README.md
+++ b/README.md
@@ -386,10 +386,14 @@ Fill in `username`, `email`, and `displayname`. Then generate the password hash:
 
 ```bash
 docker compose run --rm authelia \
-    authelia crypto hash generate argon2 --password 'your-real-password'
+    authelia crypto hash generate argon2
 ```
 
-Copy the `$argon2id$...` line and paste it as the `password:` value in `users_database.yml`.
+Authelia prompts for the password and a confirmation without echoing --
+the plaintext never hits your shell history or `ps aux`. Copy the
+`Digest: $argon2id$...` line from the output and paste the digest
+(everything from `$argon2id` onward) as the `password:` value in
+`users_database.yml`.
 
 ### 6. Pre-create the Authelia log file
 
@@ -551,9 +555,10 @@ Verify in a private browser window: `https://cam.yourdomain.com` should go to Au
 Append to `authelia/users_database.yml`, generate a hash:
 ```bash
 docker compose run --rm authelia \
-    authelia crypto hash generate argon2 --password 'new-password'
+    authelia crypto hash generate argon2
 ```
-Paste the hash as `password:`. Restart or wait 5 minutes for auto-reload.
+Authelia prompts for the password (no echo, not in shell history). Paste
+the printed digest as `password:`. Restart or wait 5 minutes for auto-reload.
 
 ### Disable a user
 
diff --git a/authelia/users_database.yml.example b/authelia/users_database.yml.example
index 546be7f..87cca4c 100644
--- a/authelia/users_database.yml.example
+++ b/authelia/users_database.yml.example
@@ -2,13 +2,17 @@
 ###############################################################################
 # Authelia users database
 #
-# Copy this to users_database.yml (gitignored) and edit. Generate the
+# Copy this to users_database.yml (gitignored) and edit. Generate each
 # password hash with:
 #
 #   docker compose run --rm authelia \
-#     authelia crypto hash generate argon2 --password 'your-plaintext-pass'
+#     authelia crypto hash generate argon2
+#
+# Authelia prompts for the password and a confirmation without echoing,
+# so the plaintext never hits shell history or `ps aux`. Output ends
+# with `Digest: $argon2id$v=19$m=...`. Paste the digest (everything from
+# `$argon2id` onward) as the `password:` value below.
 #
-# Paste the resulting `$argon2id$v=19$m=...` string as the `password:` value.
 # Restart Authelia for changes to take effect (or wait refresh_interval).
 ###############################################################################