guides · how-to
Add a connection password
The borrowed-laptop defense: even a paired device has to prove the right person is holding it.
Pairing trusts the device. The connection password adds a second factor for the person: whoever opens a session must also know a secret, even from a laptop you’ve paired before.
Set it
In the host’s admin UI: Settings → Connection Password. Or from an admin shell:
nearzero-host password set
nearzero-host password scope wanChoose a scope
| Scope | Who gets challenged |
|---|---|
wan (default) | Clients arriving from outside your LAN — including Tailscale |
always | Every client, every time |
never | Nobody (the verifier stays on disk, unused) |
Clients prompt when the host asks, and can remember the password per host.
What’s actually stored
Not the password. The host keeps an Argon2id verifier — memory-hard, roughly 100 ms per guess by design — and challenges clients with a fresh salt on every connection, so a captured exchange says nothing about the next one. Plaintext never touches disk on either end.
Brute force is throttled independently of the crypto: 5 consecutive failures is a 1-minute ban, 10 failures in 10 minutes is a 10-minute ban, keyed to the client’s cryptographic identity rather than its IP. One device gets one password prompt at a time, and a prompt left unanswered for two minutes closes the connection.