Home Assistant login: how it works, and how to fix it when it doesn’t (2026)

Getting into your Home Assistant dashboard is normally a five-second job: open a browser, type an address, sign in. When it goes wrong, Home Assistant login stops being a convenience and becomes a lock on your own front door — because there is no central cloud account holding your password, and no “forgot password” email waiting to rescue you. This guide explains how the login system actually works in 2026, where your credentials really live, why the same account behaves differently at home and on mobile data, and the documented recovery routes when you cannot get in. It is built from Home Assistant’s own official documentation, Nabu Casa’s published specifications and community troubleshooting reports rather than hands-on testing.

Last verified: January 2026

At a glance

How Home Assistant login actually works

Home Assistant is self-hosted software. The login page you see at http://homeassistant.local:8123 is served by the small computer sitting in your cupboard, and the credentials are stored on that device’s own storage. There is no central Home Assistant account in the cloud holding your password. That single fact explains most of the confusion around the phrase “Home Assistant login”: people search for it expecting a web account they can reset by email, and instead find a self-hosted authentication system they have to administer themselves.

The owner account is not the same as an admin account

The first login you create during the onboarding wizard becomes the owner account, and it functions as the master key. Owner accounts can add other users and grant admin rights. Two properties matter enormously in practice: an owner account cannot be deleted, and it cannot be demoted to a normal user. Every admin account created afterwards is a distinct thing — useful for day-to-day management, but not equivalent to the owner.

Home Assistant’s official authentication documentation is blunt on the practical consequence: make sure a second admin account exists before you need one. Doing so costs a minute during setup; skipping it is the difference between a two-minute fix and a full reinstall later. See home-assistant.io/docs/authentication/ for the full permissions model.

Local and remote are two different problems

On your home network, login is a name-resolution problem: mDNS usually resolves homeassistant.local to the right device, and if it does not, the device’s IP address always works. Once you leave the house, it becomes a networking problem, because your dashboard is not reachable from the internet unless you deliberately make it so. Remote access does not change who you log in as — it only changes where you reach the login page from.

Finding the login URL when homeassistant.local fails

The default local URL is http://homeassistant.local:8123, resolved by mDNS (multicast DNS), the same zero-configuration technology that lets printers and smart speakers announce themselves on a network. Windows is the weakest link here and frequently fails to resolve mDNS names, which is why so many “Home Assistant login not working” reports come from Windows laptops while the same setup works fine on a phone.

Three fallbacks solve this reliably:

• Your router’s DHCP client list. Nearly every router shows connected devices and their assigned IP addresses; find the Home Assistant box and navigate to that IP on port 8123.
• A static IP reservation. Pinning the device to a fixed address in your router settings stops the address changing after a reboot — worth doing permanently, because a client-list lookup only works while you can reach the router.
• Editing the hosts file. This maps the friendly name to the IP address at operating-system level, bypassing mDNS entirely.

Home Assistant’s official troubleshooting documentation covers all three; the important point is that a failure to resolve the name is not an authentication failure at all, and no amount of password resetting will fix it.

Password recovery: what happens when you are locked out

This is the section nobody reads until they need it, and the stakes are higher than most users expect.

A local owner account has no email recovery. Ever. There is no reset link, no security question and no support desk that can restore it. If you still have SSH access to the machine, the documented recovery path is to connect over SSH and run the command-line authentication reset utility — hass --script auth reset --username, followed by the name of the account you need to reset — as described in the official CLI documentation. If you have neither SSH access nor a second admin account, the documented last resort is a reflash: wiping the installation and starting again from the onboarding wizard. That means losing your configuration unless you have taken a backup.

A Nabu Casa account is a completely separate credential — and one where email recovery does exist. It is important to be clear about what it recovers, though: resetting your Nabu Casa account restores access to the Cloud subscription, not to your dashboard. The dashboard login is still the local username and password stored on your own hardware. Confusing the two is one of the most common sources of frustration reported in community threads.

Remote sign-in: Cloud, VPN or port forwarding

Once you leave the house, three approaches are commonly used.

1. Home Assistant Cloud (Nabu Casa). This is a relay tunnel: your instance connects outbound to Nabu Casa’s servers, and your remote browser or app connects to that same relay. Crucially, it changes where you reach the login page, not who you log in as — your local username and password still apply unchanged. It is the least configuration-heavy option, requiring essentially a single toggle.

2. A self-managed tunnel such as Tailscale, Cloudflare Tunnel or a WireGuard VPN. These require configuration and a way for the remote device to join the tunnel, but they keep everything in your own hands.

3. Port forwarding plus Let’s Encrypt. This exposes your login page directly to the internet. It works, but Home Assistant’s official remote-access documentation recommends Cloud or a VPN instead of direct port forwarding, and security-conscious owners have been moving away from it for years.

Remote access and the Companion app

On first run, the official Companion app uses a my.home-assistant.io redirect to find your instance. If the app reports that it cannot find your instance, the usual cause is that no remote URL is configured — check Settings → Home Assistant Cloud, where the remote address is set. Without it, the app can only reach the dashboard while you are on the same network.

MFA, IP bans and the 401 error

Home Assistant ships with built-in TOTP multi-factor authentication (time-based one-time passwords, the six-digit codes generated by an authenticator app), documented at home-assistant.io/docs/authentication/multi-factor-auth/. Enabling it means a stolen password alone is not enough to reach your dashboard.

The most common cause of a sudden, unexplained lockout, however, is not MFA but ip_ban_enabled in configuration.yaml. When enabled, Home Assistant automatically bans an IP address after a configured number of failed login attempts — a sensible brute-force defence that also catches legitimate users who mistype a password a few times on a phone. The recovery procedure is documented: remove the offending entry from ip_bans.yaml and restart Home Assistant.

Separately, a 401 error means the server actively rejected your credentials — it is not a connection fault. The usual culprits are a stale session cookie or the wrong username. Clearing your browser cookies for that address is the first thing to try, and it resolves the majority of cases.

Hardware: what changes about login, and what does not

The box running Home Assistant determines how much work stands between you and that first login box. It does not change the authentication system itself.

Home Assistant Green

Best for: the easiest possible first login and the shortest route to a working owner account.

Key specifications (manufacturer-stated): Rockchip RK3566 processor, 4GB of RAM and 32GB of eMMC storage. Home Assistant OS comes pre-installed, so the owner-account wizard runs on first boot with zero terminal work — no image flashing, no storage wiring, no DNS troubleshooting before you see a login page.

Standout strength: it removes the entire class of setup problems that produce “I cannot even reach the login screen” posts. The onboarding flow is built around creating the owner account.

Honest caveat: it is the least expandable option of the two official hubs, and the fixed 32GB of storage is what you live with.

Where to buy: UK buyers typically check Pimoroni and The Pi Hut, where it is usually stocked at approximately £90–£100 (verified 2026).

Verdict: the sensible default for anyone whose priority is being logged in and running today.

Home Assistant Yellow

Best for: owners who want more headroom, built-in radios and the option of faster storage.

Key specifications (manufacturer-stated): Raspberry Pi CM4-based, with a built-in Zigbee/Thread radio and support for M.2 NVMe storage. Because the compute module is the variable, the specification you receive depends on which CM4 is fitted.

Standout strength: the integrated Zigbee/Thread radio and NVMe support mean fewer add-ons bolted on later, and the same zero-terminal onboarding advantage as Green.

Honest caveat: variant availability has genuinely changed over time — kit versus CM4-bundle configurations and the PoE variant have shifted — so verify the current variant against the live Nabu Casa product page before ordering rather than relying on an older listing.

Where to buy: directly from Nabu Casa, plus UK Raspberry Pi stockists. Expect approximately £130–£160 depending on the CM4 specification fitted.

Verdict: the better long-term buy if you want radios and NVMe in one official box, provided you confirm exactly which variant you are getting.

Home Assistant Cloud (Nabu Casa)

Best for: remote login without opening router ports or configuring a VPN.

Key specifications: a relay tunnel service priced at approximately $6.99 per month or $65 per year (USD; there is no UK-specific pricing, so the sterling equivalent moves with exchange rates). A 31-day free trial is available. There is no affiliate programme attached to the subscription.

Standout strength: it removes the port-forwarding problem entirely, and the same subscription enables Alexa and Google integrations.

Honest caveat: it is a relay, not a replacement for your local credentials — and it does not provide email recovery for your dashboard login, only for the Nabu Casa account itself.

Where to buy: direct from Nabu Casa; check the product and pricing page for current figures and trial terms.

Verdict: the simplest legitimate answer to remote sign-in, and the one the official documentation recommends alongside a VPN.

What hardware does not change

Login behaviour is identical across all install methods — Green, Yellow, a self-built Raspberry Pi, a virtual machine or a NAS container. Authentication is software, not hardware, so the recovery rules above apply whichever route you took.

Choosing your setup: three decisions that shape login

Hardware first. If you want the shortest path from unboxing to owner account, an official hub with Home Assistant OS pre-installed removes the pre-login troubleshooting entirely.

Remote access second. Cloud is the least configuration; a self-managed tunnel is the most self-contained; port forwarding is the option the official documentation steers you away from.

Recovery readiness third, and most important. Create a second admin account during setup, and confirm your remote URL is set under Settings → Home Assistant Cloud if you rely on the Companion app.

Sources

• Authentication and permissions: home-assistant.io/docs/authentication/
• Multi-factor authentication: home-assistant.io/docs/authentication/multi-factor-auth/
• Remote access guidance: home-assistant.io/docs/configuration/remote-access/
• Nabu Casa product and pricing page — verify current pricing and variant availability before purchase
• r/homeassistant discussions on ip_ban lockouts — search the subreddit for recent dated threads, as these report the same pattern repeatedly

FAQ

Can I reset my Home Assistant owner password by email? No. A local owner account has no email recovery mechanism at all — there is no reset link and no account recovery service. If you have SSH access, the documented route is the command-line authentication reset utility; if you have neither SSH nor a second admin account, a reflash is the documented last resort. Nabu Casa’s email recovery exists, but it restores your Cloud subscription, not your dashboard login.

Why does homeassistant.local work on my phone but not my Windows PC? Because the address relies on mDNS, and Windows frequently fails to resolve mDNS names reliably. The dashboard is almost certainly fine — the name simply is not resolving on that machine. Use your router’s DHCP client list to find the device IP, reserve a static IP so it never changes, or add a hosts-file entry mapping the name to the address.

Does Home Assistant Cloud change my username and password? No. Home Assistant Cloud is a relay tunnel, which means it changes where you reach the login page from, not who you log in as. Your local username and password still apply exactly as they do at home. The Cloud subscription is a separate Nabu Casa credential that sits alongside your local account.

How do I stop Home Assistant locking me out after failed logins? That behaviour comes from ip_ban_enabled in configuration.yaml, which bans an IP address after repeated failed attempts. It is a deliberate brute-force defence, and it is the most commonly documented cause of sudden lockouts. To recover, remove the ban entry from ip_bans.yaml and restart Home Assistant.

What does a 401 error actually mean? A 401 means the server received your request and rejected your credentials — it is not a connectivity problem, so restarting your router will not help. The most frequent causes are a stale session cookie or the wrong username. Clearing the browser cookies for that address is the first thing to try.

Should I use Home Assistant Cloud or a VPN for remote login? Both are recommended by Home Assistant’s official remote-access documentation, and direct port forwarding is not. Cloud is a single toggle with a subscription attached; a VPN keeps everything under your own control but needs configuration on every device that connects. The login credentials are identical either way.

Which is easier to set up for a first-time owner account, Green or Yellow? Both arrive with Home Assistant OS pre-installed, so the owner-account wizard runs without any terminal work on either. The real difference is expandability and price: Green is the simpler, cheaper box at approximately £90–£100, while Yellow adds a built-in Zigbee/Thread radio and M.2 NVMe support at approximately £130–£160 depending on the CM4 fitted. Login itself behaves identically on both.

Where to buy in the UK

Home Assistant Green is typically stocked by Pimoroni and The Pi Hut at approximately £90–£100. Yellow is sold directly by Nabu Casa, with UK Raspberry Pi stockists also carrying it, at approximately £130–£160 depending on the CM4 specification — confirm the current variant on the live product page before ordering, as kit, CM4-bundle and PoE configurations have changed over time. Home Assistant Cloud is purchased directly from Nabu Casa at approximately $6.99 per month or $65 per year, with a 31-day free trial and no affiliate programme.