Recommended Free Tools
Uptime Kuma’s documented setup does not provide a dependable built-in multi-user administration system. A fresh installation creates one local account during initial setup; there is no verified, version-independent “Settings > Users” workflow for adding colleagues, assigning roles, or limiting monitors. If several people need access, protect that account carefully and evaluate an authentication layer in front of Uptime Kuma rather than assuming that sharing the administrator password provides separate identities or an audit trail.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
What user management Uptime Kuma supports
Uptime Kuma is self-hosted monitoring software. The documented authentication model centers on one local account created when the web setup wizard is completed. That account is used to sign in to the application and manage monitors, notification settings, and other data available to an authenticated session.
As an Amazon Associate I earn from qualifying purchases.
Project issue #7203 describes the single-user limitation directly. Older issues, including #128 and #2143, describe teams sharing one account because separate users and session control were unavailable. Those reports describe the product state associated with the versions discussed in each issue, so check the exact Uptime Kuma release you are deploying before relying on any newer behavior.
Most importantly, do not infer that a page called Settings > Users exists. Unless you have independently verified such a page in your installed version, the safe assumption is that native user creation, role assignment, and per-monitor permissions are not available.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
What is not established as a built-in feature
- Multiple local Uptime Kuma accounts with independent sessions.
- Administrator, editor, viewer, or custom roles.
- Permissions limited to particular monitors or monitor groups.
- LDAP or Active Directory sign-in.
- Single sign-on (SSO) or a documented external identity-provider integration.
- Reliable per-person audit history inside the Uptime Kuma interface.
Open requests for roles and privileges describe a proposed design in which one person could add monitors without changing or deleting another person’s monitors. A proposal or issue discussion is not evidence that the workflow has shipped.
Check your version and deployment before changing access
Instructions vary with the release and the way Uptime Kuma is run. Record both before troubleshooting authentication.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problems- Identify the container image or package version. For Docker, run
docker ps --format 'table {{.Names}}t{{.Image}}'and note the image tag. If the image is named without a tag, your deployment may be following a moving default rather than a pinned release. - Check the compose file or run command. Confirm which host port maps to Uptime Kuma’s web port and which host directory or volume maps to
/app/data. - Record the deployment date and upgrade path. A feature seen in a development build, fork, or later release should not be assumed to exist in the version currently serving your users.
- Back up the data directory before account or authentication work. The data directory contains the application database and configuration. A backup gives you a recovery path if an upgrade, migration, or proxy change prevents login.
In the common Docker deployment, the official image is louislam/uptime-kuma, the web application is exposed on port 3001, and /app/data must be persisted. Keep that directory on storage supporting POSIX file locks; the installation guidance warns that unsuitable locking behavior can corrupt the SQLite database.
How to create the first Uptime Kuma account
The first account is created during initial web setup, not from a user-management screen.
- Start the Uptime Kuma service with its data directory persisted.
- Open the mapped web address, commonly a host port forwarding to container port
3001. - Complete the setup form and create the initial username and password.
- Sign in and configure two-factor authentication if the installed release offers it.
- Store the credentials in an approved password manager and restrict them to the people who administer the monitoring system.
If the setup wizard does not appear, the persistent data directory may already contain an initialized installation. Do not delete that directory to force the wizard unless you intentionally want to destroy the existing monitoring database. Instead, determine which account was created originally and use the documented recovery process for that release.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Can you add another user from the Uptime Kuma interface?
For the documented single-account model, no reliable native procedure exists. Do not direct another person to a nonexistent user page or suggest that creating a second browser session creates a second account. Multiple browser sessions are still sessions for the same local identity.
Sharing one administrator password can let a team operate the dashboard, but it does not provide:
- separate credentials that can be revoked for one person;
- proof of which individual changed a monitor;
- least-privilege access for someone who only needs to view status;
- independent password or two-factor settings; or
- an uncomplicated response when a team member leaves.
If the same account must be used temporarily, establish an operational policy: keep the credential in a shared password manager, enable two-factor authentication where available, record changes in an external change log, and rotate the password when membership changes. This reduces exposure but does not turn the account into a multi-user system.
Ways to give several people access without claiming native roles
When separate identities are a requirement, treat the solution as an architecture decision outside Uptime Kuma’s documented local account model.
Option 1: Keep one local account and control access operationally
This is the simplest and most compatible approach. It requires no integration and works with the existing setup, but it scores poorly for separate identities, least privilege, and attribution. Use it only when the group is small, the monitoring data is not highly sensitive, and the team accepts shared-account limitations.
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Option 2: Put a reverse proxy or access gateway in front
A proxy can require network-level controls, client certificates, or an organizational login before a request reaches Uptime Kuma. It can reduce who can reach the application, but it does not automatically create Uptime Kuma users. Unless the application itself consumes an authenticated identity and records it, every permitted person may still operate the same local account.
Before adopting this pattern, verify:
- the proxy’s authentication happens before the request is forwarded;
- unauthenticated requests cannot bypass the proxy and reach port 3001 directly;
- WebSocket or Socket.IO traffic is forwarded correctly;
- health checks and notification callbacks still work; and
- the proxy’s logs are retained if they are your only person-level access record.
Restrict the container or host firewall so that the application port is reachable only through the intended gateway. A proxy that is available on the public network while port 3001 remains exposed defeats the access boundary.
Option 3: Use a prospective external identity integration
Open requests discuss LDAP, Active Directory, group filtering, role mapping, BetterAuth, and other external authentication directions. Issues #5359 and #6200 are requests for these capabilities, not documentation of a shipped, supported integration. Do not label LDAP, SSO, BetterAuth, or per-monitor role mapping as built in without confirming support for the exact release and installation.
If you test an integration supplied by a third party or a future release, maintain a local fallback account, test upgrades in a non-production instance, and document how to bypass the identity provider during an outage. An identity provider that is unavailable must not leave operators unable to see an outage or repair monitoring.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Compare the practical approaches
| Approach | Separate identities | Least privilege or per-monitor control | Compatibility | Auditability | Operational complexity | Identity-provider outage recovery |
|---|---|---|---|---|---|---|
| Native local account | No; one documented account | No documented per-user control | Highest, because it is the default model | Limited; activity is associated with the shared account | Low | Unaffected by an external provider |
| Reverse proxy or access gateway | Possibly at the gateway, not necessarily inside Uptime Kuma | Usually no application-level monitor permissions | Must be tested for WebSocket and login behavior | Depends on proxy and application logs | Medium | Requires a documented bypass or local account |
| External LDAP, SSO, or BetterAuth-style integration | Potentially, if the release and connector support it | Potentially, but role mapping is not established in the documented native setup | Version- and connector-dependent | Potentially stronger when identity and application logs correlate | High | Must include a tested local fallback and recovery procedure |
The table separates what an access layer can do from what Uptime Kuma itself records. A gateway can identify a person at the edge while the application still sees one local account.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Protect the account and the monitoring data
Use durable, protected storage
Persist /app/data outside the disposable container. If the container is recreated without that volume, the application may start as a new installation or appear to have lost its monitors and account. Protect the host directory from unneeded users and include it in backups.
Preserve SQLite locking behavior
Uptime Kuma’s installation guidance warns that POSIX file locks are needed to avoid SQLite corruption. Do not place the data directory on storage whose locking semantics differ from what the application expects, and avoid two containers mounting the same database simultaneously.
Secure network exposure
- Expose the web port only on the intended interface or through the intended reverse proxy.
- Use HTTPS at the public boundary and secure the proxy’s certificate and private key.
- Do not publish an administrative dashboard directly to the internet without an access-control plan.
- Review firewall rules after upgrades, because a changed port mapping can unintentionally expose the service.
Handle credentials as a shared-account risk
Use a unique, long password and store it in a controlled password manager. Enable two-factor authentication when supported by your release. Do not place the password in compose files, shell history, issue trackers, or chat. Rotate it after suspected disclosure or personnel changes, and keep a sealed recovery record available to the responsible operators.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
What the internal Socket.IO API means for user access
Uptime Kuma’s internal API documentation describes authentication over Socket.IO. A client connects and sends a login event with a username and password; a two-factor token may also be supplied. A client can instead use loginByToken with a token obtained after a successful login when “Remember Me” was selected.
This is an implementation detail, not a supported user-management interface. The documentation warns that the API is internal, is not officially supported for third-party integrations, and may change without notice. Treat tokens like passwords: do not paste them into tickets, commit them to source control, or distribute them to every operator.
Best Value
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T110. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Certified with the new FIDO2 standard, T110 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
- Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
- Fits USB-A port : Insert the T110 security key into the USB-A port of each service and log in conveniently with one touch
- For the driver download and user guide, please visit TrustKey Solutions Home support page.
Because the API describes authentication for the existing account model, it does not establish separate local users, roles, or monitor ownership. Automation built on it should be pinned to a tested version and reviewed after upgrades.
Troubleshoot common access problems
The login page keeps rejecting a known password
- Confirm that you are reaching the intended instance and not a second container or proxy target.
- Check the container name, image tag, mapped port, and persistent volume.
- Review application logs for database or migration errors.
- Verify that a proxy is not stripping WebSocket or Socket.IO traffic.
- Do not delete
/app/dataas a first response; that can remove the account and monitoring data rather than repair it.
The account or monitors disappeared after recreation
Check whether the volume containing /app/data was omitted, renamed, or mounted at the wrong path. Restore the last known-good backup only after stopping the application and confirming that the restored files belong to the intended instance.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Users can reach Uptime Kuma without passing through the gateway
Inspect host firewall rules, container port publishing, cloud security groups, and alternate DNS records. Bind the service to a private interface or remove the direct port publication where appropriate, then test from an untrusted network.
An external identity provider is unavailable
Use the documented emergency path: a protected local account, a break-glass gateway rule, or console access to the host. Test that path before an outage. If no recovery path exists, adding an identity layer has increased operational risk rather than reduced it.
A safe access plan for a small monitoring team
- Pin and record the Uptime Kuma version and deployment method.
- Back up the persistent
/app/datadirectory and verify that a restore is possible. - Keep the native account protected by a password manager and two-factor authentication when available.
- Decide whether a shared account is acceptable for the team’s risk level. If it is, document who may use it and how changes are logged.
- If separate identities are mandatory, place a tested gateway in front of the service and restrict direct access to port 3001.
- Do not promise LDAP, SSO, roles, or per-monitor permissions until the exact release and connector have been tested.
- Document an outage procedure that works when the gateway or identity provider is down.
- Re-test login, monitor editing, notifications, WebSocket connections, backups, and recovery after every Uptime Kuma or proxy upgrade.
Bottom line
With the documented Uptime Kuma setup, you manage one local account rather than a directory of users. There is no dependable native workflow for adding accounts, assigning roles, or granting per-monitor permissions. Protect the initial account and its persistent data, avoid exposing the application directly, and treat reverse proxies or external identity services as separately engineered, version-specific layers with their own audit and recovery responsibilities.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
