I lost my password
There’s no “forgot password” email
Self-hosted and single-user — no account-recovery email, because no email is tied to your account. Recovery works differently here.
The default: the machine itself is already trusted
Any process on the machine the app runs on — including you, there or over SSH — can reach the
app without a password at all. This is localhost/loopback trust, on by default. A password
only matters from a different device.
Practically: locked out on your phone but have access to the machine itself? Open the app
there directly (or via http://localhost:8080 over SSH port-forwarding) — straight in, no
prompt — then set a new one from Settings → Security.
If you genuinely can’t reach the machine locally
A temporary escape hatch: set AUTH_DISABLED=true and restart — turns the login requirement off
entirely, then remove the variable and restart once done. Operator-level, last-resort only (it
opens the app to anyone reaching it over the network while set). See Environment
variables.
Changing your password still requires the old one — no self-service reset without either that or direct access to the machine’s data directory. That stuck? Treat it as data recovery and back up your data directory first.
Too many failed attempts
5 wrong attempts from the same location within 15 minutes blocks login (HTTP 429), regardless of whether the 6th would’ve been right. Wait out the window — a brute-force guard, not a sign anything’s broken.
How to confirm it’s fixed
You can log in from the device you were locked out on, and Settings → Security shows a password is set.