Home Assistant stores token secrets in cleartext, and changing your password revokes none of them

Home Assistant: the password is not the key – token secrets in cleartext

A security researcher tested Home Assistant 2026.11.0 and found that every user's refresh-token secret and JWT signing key sit unhashed in config/.storage/auth, while passwords are bcrypt-hashed. Two token classes never expire—long-lived tokens last ten years—and none of the four password-change paths revoke them. A copied token still worked after a verified password change. Any config-directory or backup read becomes durable, password-change-resistant access to the home.