qBittorrent PW resetting
Posted by DjunaBug
Tom AI recommended I share the following thread here: After resetting the username/password in qbittorrent, when I returned to the WebUI some time later, I couldn't log in. I saw the recommendation to remove the line for WebUI\PasswordPBKDF2 in .config/qBittorrent/qBittorrent.conf and did so, after stopping qbittorent. Then I restarted, generating the log below. I still cannot login to the qbittorrent WebUI, and I see that the Radarr and Sonaar connections to qbittorrent are broken, too. 2026-07-03T14:57:23.479884476Z Brought to you by linuxserver.io 2026-07-03T14:57:23.479887346Z ─────────────────────────────────────── 2026-07-03T14:57:23.480208020Z 2026-07-03T14:57:23.480215319Z To support LSIO projects visit: 2026-07-03T14:57:23.480219098Z https://www.linuxserver.io/donate/ 2026-07-03T14:57:23.480221641Z 2026-07-03T14:57:23.480224148Z ─────────────────────────────────────── 2026-07-03T14:57:23.480227391Z GID/UID 2026-07-03T14:57:23.480238753Z ─────────────────────────────────────── 2026-07-03T14:57:23.484941668Z 2026-07-03T14:57:23.484959829Z User UID: 1000 2026-07-03T14:57:23.484963741Z User GID: 1000 2026-07-03T14:57:23.484966836Z ─────────────────────────────────────── 2026-07-03T14:57:23.486734454Z Linuxserver.io version: 5.2.0v2.0.12-ls458 2026-07-03T14:57:23.487008918Z Build-date: 2026-05-17T08:57:46+00:00 2026-07-03T14:57:23.487018760Z ─────────────────────────────────────── 2026-07-03T14:57:23.487022660Z 2026-07-03T14:57:23.618027434Z [custom-init] Files found, executing 2026-07-03T14:57:23.621910806Z [custom-init] 00-set-admin-password.sh: executing... 2026-07-03T14:57:23.633757506Z [sparkbox-qbit-init] Detected broken quoted @ByteArray hash from old SparkBox version — rewriting unquoted. 2026-07-03T14:57:23.639882648Z [sparkbox-qbit-init] Rewrote /config/qBittorrent/qBittorrent.conf with unquoted hash. 2026-07-03T14:57:23.658867442Z [sparkbox-qbit-init] Injected admin password + LAN-access settings into /config/qBittorrent/qBittorrent.conf 2026-07-03T14:57:23.660163159Z [custom-init] 00-set-admin-password.sh: exited 0 2026-07-03T14:57:23.848471277Z WebUI will be started shortly after internal preparations. Please wait... 2026-07-03T14:57:23.943729856Z 2026-07-03T14:57:23.943747126Z Information 2026-07-03T14:57:23.943751348Z To control qBittorrent, access the WebUI at: http://localhost:8080 2026-07-03T14:57:24.739925754Z Connection to localhost (::1) 8080 port [tcp/http-alt] succeeded! 2026-07-03T14:57:24.747903455Z [ls.io-init] done. 🔧 Tom AI wants to: Restart the sb-qbittorrent container ✓ Ran — see the result below. 🔧 working on your SparkBox… Restarted — that clears the IP ban. Now log in fresh: WebUI: http://<NAS-IP:8089 Username: admin Password: whatever SparkBox's init wrote — check /opt/sparkbox/state/qbittorrent-admin-password.txt on the host (sudo cat /opt/sparkbox/state/qbittorrent-admin-password.txt). Since your .conf line is gone, the init script's "inject admin password" step (you can see it in the log — "Injected admin password + LAN-access settings") should've written that same password back into the fresh config on this restart. Once you're in, double check Radarr/Sonarr's qBittorrent download-client settings still show that same password (Settings → Download Clients → qBittorrent) — if they were pointed at your old manual password before, update them to match, then hit "Test." Don't touch the host field — it should stay localhost or sb-gluetun, never sb-qbittorrent. If login still fails after this (not banned, actual wrong password), paste me what happens and I'll dig further — but 9 times out of 10 this clears it. ↗ I used sudo cat /opt/sparkbox/state/qbittorrent-admin-password.txt to check the PW and pasted it into the pw field on the qbittorent WebUI, but still got the error: Invalid Username or Password. Server response: Unauthorized 🔧 working on your SparkBox… Container's healthy, everything else on the box is fine — this is isolated to that one config file. Here's what's actually going on: that "Detected broken quoted @ByteArray hash... rewriting unquoted" line is a one-time migration check, and it's still firing on every restart. That means qBittorrent itself isn't accepting the hash format the init script is writing — so it never persists a working password, it just keeps rewriting the same thing and injecting it, and the WebUI never matches it. That's a config file stuck in a bad state, not you typing the password wrong. Cleanest fix is letting the media module's init logic rebuild qBittorrent's setup from scratch rather than patching the same broken conf file again. Want me to restart the whole media module (not just the container) — that re-runs the full init sequence against qBittorrent, Sonarr, and Radarr together, so the arr connections come back in sync with whatever password lands? ↗ Didn’t fully fix it? Share to demox so Tom can ship an update Can you re-init qBittorent only? I'd rather not lose the preferences I've set up in Sonarr and Radarr. 🔧 working on your SparkBox… Confirmed — it's the exact same loop on every boot. The init script keeps detecting a "broken quoted hash," rewrites it, injects the password... and it still doesn't take. That's a stuck/corrupted qBittorrent.conf, not something a plain restart clears, since restart just re-runs this same script against the same file. Restarting just the sb-qbittorrent container won't fix it — you'd get this identical log again. To actually break the loop I need to run fixmediapermissions, which re-runs the arr-bootstrap setup and re-triggers this password/config injection cleanly. It only touches media-folder permissions and root-folder registration on the media side — it does not touch Sonarr's or Radarr's own databases, so your settings there are safe. Want me to run it? ↗ Okay I hit a problem reaching the AI service mid-task: request failed. Try again in a moment. ↗ Yes please run fixmediapermissions as you described above. 🔧 Tom AI wants to: Fix media folder permissions so downloads can import ✓ Ran — see the result below. 🔧 working on your SparkBox… 🔧 working on your SparkBox… 🔧 working on your SparkBox… Yeah — I've got to be straight with you: same exact log again. "Detected broken quoted @ByteArray hash... rewriting unquoted" fired again, and it's still injecting a password into a conf file that then doesn't authenticate. That tells me this isn't a permissions or one-time-migration problem at all — the init script's "unquote the hash" fix isn't actually producing a hash format qBittorrent will accept, on every single run. Container itself reports healthy (that's just Docker checking the port's open, not that login works), so this is a legit bug in the SparkBox init logic, not your setup. At this point I'd stop poking at it — you've already tried the documented workaround (remove PasswordPBKDF2), a plain restart, and a full permissions re-init, and it's the identical failure every time. That's worth Tom actually looking at. Click "Share to demox" below and post this thread — the repeating "Detected broken quoted @ByteArray hash" log line is the key detail Tom's team needs to reproduce it. In the meantime, if you need qBittorrent working now, you could manually edit /opt/sparkbox/data/media/config/qbittorrent/qBittorrent.conf (or wherever your box's config lives) and set a plaintext temp password via qBittorrent's --webui-password bootstrap flag, but honestly, given it's actively rewriting that file on every boot, I'd rather get this fixed at the source than have you fight the init script by hand.
4 replies
DjunaBug wrote:
I'm on Ubuntu Server. Happy to share any further details as needed.
tomspark wrote:
Thanks for the detail — Ubuntu noted. The log the Tom AI included tells us exactly what's happening: the 'Detected broken quoted @ByteArray hash — rewriting unquoted' line fires on every restart and rewrites a hash that qBittorrent won't actually accept. That's a bug in our init script, nothing you caused. Your downloads should still queue through Sonarr and Radarr in the background — those connect separately. We're logging this and will post an update here when the fix ships.
Chris wrote:
Twenty-five days with no update from us on this — that's ours to own, and I'm sorry. Our own log misled the diagnosis. That init script printed "Injected admin password" even on the boots where it skipped injection entirely, which is exactly why it looked like an endless inject-then-reject loop. Tom fixed that line itself in v1.6.411. The likelier cause is the username. You reset the username as well as the password, and the injector only writes WebUI\\Username=admin when it builds a config from scratch — on an existing one it rewrites the password line and leaves your custom name sitting there. That is a documented lockout on our side. Over SSH: sudo sparkbox upgrade sudo sparkbox reset-password qbit That stops qBit, clears both lines and prints a fresh password — log in as admin. Then sudo sparkbox arr-bootstrap re-points Sonarr and Radarr. — Chris
tomspark wrote:
Heads up — 1.6.545 just shipped and should cover what you reported here. You can grab it straight from the dashboard: Settings → Updates → Update SparkBox. Let me know if that sorts it, or if you're still hitting it. (Prefer the terminal? sudo sparkbox upgrade — note update only refreshes app images and will not move you to a new release.)