Home Assistant: the password is not the key – token secrets in cleartext

A security report on Home Assistant 2026.11.0 argues that a password change does not necessarily secure an installation after its configuration or a backup has been exposed. It says refresh-token secrets and per-token JWT signing keys for all users are stored in plaintext in config/.storage/auth, unlike passwords, which are bcrypt-hashed. The report also finds that long-lived and system refresh tokens have no expiration, while recommended long-lived access tokens last ten years and the API accepts caller-chosen lifespans without an upper limit. According to the report, none of four password-change or reset routes - self-service, administrator, Supervisor, or command line - revokes existing tokens.

The author says a live test confirmed that a refresh token copied before a password change could still obtain new access, and a pre-existing ten-year token remained usable. The report further states that the automatic-backup password is stored in plaintext in .storage/backup and that settings backups include .storage/auth, allowing old tokens to return when a backup is restored. The findings do not describe unauthenticated remote access: an attacker first needs a read of the configuration directory or a backup. The concern is that a single disclosure can enable persistent access to sensitive home systems despite a password change. The author reports that of eleven checked claims, three held, five held with qualifications, and three failed, while crediting Home Assistant’s strong token-generation entropy and 30-minute access-token lifetime.