Repository navigation
How to hash credentials to make use of --credentials-hash flag? #1517
Description
Hello! Firstly, I want to thank the developers of this project for the ability to interact with TP-Link smart devices from our own terminals. This unlocks so many creative opportunities to automate our homes. You guys seriously rock.
With that said, I am investing some time in setting up kasa and am interested in using hashed credentials using the --credentials-hash flag. However, and I might be missing something, but there doesn't seem to be documentation that explains how to hash your credentials and make use of the aforementioned flag. If someone would be willing to explain how to do that, I would be happy to make a personal contribution to the project's documentation. I want to refrain from using a plain text password to authenticate to my smart devices. Please let me know. Thank you!
Activity
rytilahti commented on Jun 1, 2025
Hi there, sorry for the delayed answer.
If you did not figure this out already, you can find the credentials hash if you execute kasa with --verbose flag being set.
This hash is different per encryption protocol due to different hashing, but can be reused for devices that use the same klap parameters. Alas, this makes it somewhat awkward to use if you have devices using different versions of the encryption :-(
Feel free to create a PR to update the documentation for this, if you wish to do so!
stutstev commented on Jul 14, 2025
Thank you for getting back to me, @rytilahti!
Do you mind letting me know of specific, full commands required to get those hashed credentials?
I entered the following command:
But all I receive in return is system information. No hashed credentials were found.
stutstev commented on Jul 14, 2025
I figured it out! To authenticate to your smart device using hashed credentials, it appears you also need to use the state device command along with the --verbose flag. Additionally, when using hashed credentials, you need to specify the encryption type of a smart device using the --encrypt-type flag. Thank you for leading me in the right direction, @rytilahti!
For anyone who might need assistance with this in the future...
You can output the credentials hash and encryption type (respectively) of your smart device using this command:
Now, let's say your hash string is aBCdefgHijkLmn1234+567890= and your encryption type is KLAP.
You can authenticate to your smart device using this command:
kasa --host 192.168.x.x --credentials-host "aBCdefgHijkLmn1234+567890=" --encrypt-type KLAPFrom here, you should be good to go!
Prepare 0.11.0 (#1776)
Prepare 0.11.0.1 (#1780)