Adds CLIENT_KDF_TYPE, CLIENT_KDF_ITERATIONS, CLIENT_KDF_MEMORY, and CLIENT_KDF_PARALLELISM environment variables to allow server admins to configure the default KDF for new user registrations.
The default KDF is currently hardcoded to PBKDF2 with 600,000 iterations. Argon2id is memory-hard and significantly more resistant to GPU-based brute-force attacks, but admins have no way to set it as the default without modifying source code. This is particularly important for self-hosted family/team instances where users are unlikely to change their KDF settings manually.
That's it — sensible Argon2id defaults are applied automatically.
🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.
## 📋 Pull Request Information
**Original PR:** https://github.com/dani-garcia/vaultwarden/pull/6983
**Author:** [@dnplkndll](https://github.com/dnplkndll)
**Created:** 3/21/2026
**Status:** 🔄 Open
**Base:** `main` ← **Head:** `feat/configurable-default-kdf`
---
### 📝 Commits (1)
- [`2d68adc`](https://github.com/dani-garcia/vaultwarden/commit/2d68adcfed42d66548fb26c9d69e5b6573dbb2f1) feat: add configurable default KDF type for new user registrations
### 📊 Changes
**4 files changed** (+81 additions, -7 deletions)
<details>
<summary>View changed files</summary>
📝 `.env.template` (+14 -0)
📝 `src/api/core/accounts.rs` (+1 -1)
📝 `src/config.rs` (+32 -0)
📝 `src/db/models/user.rs` (+34 -6)
</details>
### 📄 Description
## Summary
Adds `CLIENT_KDF_TYPE`, `CLIENT_KDF_ITERATIONS`, `CLIENT_KDF_MEMORY`, and `CLIENT_KDF_PARALLELISM` environment variables to allow server admins to configure the default KDF for new user registrations.
Closes #6982
## Motivation
The default KDF is currently hardcoded to PBKDF2 with 600,000 iterations. Argon2id is memory-hard and significantly more resistant to GPU-based brute-force attacks, but admins have no way to set it as the default without modifying source code. This is particularly important for self-hosted family/team instances where users are unlikely to change their KDF settings manually.
## Changes
- **`src/config.rs`** — Add 4 config entries with input validation matching existing Argon2id parameter validation
- **`src/db/models/user.rs`** — Replace hardcoded `CLIENT_KDF_TYPE_DEFAULT` / `CLIENT_KDF_ITER_DEFAULT` constants with config-backed functions. Automatically uses sensible Argon2id defaults (3 iterations, 64MB, 4 parallelism) when `CLIENT_KDF_TYPE=1`
- **`src/api/core/accounts.rs`** — Use config values for prelogin response when email is not found (previously hardcoded to PBKDF2)
- **`.env.template`** — Document new variables
## Backwards Compatibility
- Default values produce identical behavior to current hardcoded constants
- Existing users are not affected — only new account creation and the prelogin response for unknown emails
## Testing
Tested on a self-hosted instance with `CLIENT_KDF_TYPE=1`:
- Prelogin endpoint returns `{"kdf": 1, "kdfIterations": 3, "kdfMemory": 64, "kdfParallelism": 4}` for unknown emails
- New account registration creates accounts with Argon2id KDF
- Existing accounts retain their current KDF settings
- Validation rejects invalid parameters (e.g., memory < 15MB, parallelism > 16)
## Example
```env
CLIENT_KDF_TYPE=1
```
That's it — sensible Argon2id defaults are applied automatically.
---
<sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
📋 Pull Request Information
Original PR: https://github.com/dani-garcia/vaultwarden/pull/6983
Author: @dnplkndll
Created: 3/21/2026
Status: 🔄 Open
Base:
main← Head:feat/configurable-default-kdf📝 Commits (1)
2d68adcfeat: add configurable default KDF type for new user registrations📊 Changes
4 files changed (+81 additions, -7 deletions)
View changed files
📝
.env.template(+14 -0)📝
src/api/core/accounts.rs(+1 -1)📝
src/config.rs(+32 -0)📝
src/db/models/user.rs(+34 -6)📄 Description
Summary
Adds
CLIENT_KDF_TYPE,CLIENT_KDF_ITERATIONS,CLIENT_KDF_MEMORY, andCLIENT_KDF_PARALLELISMenvironment variables to allow server admins to configure the default KDF for new user registrations.Closes #6982
Motivation
The default KDF is currently hardcoded to PBKDF2 with 600,000 iterations. Argon2id is memory-hard and significantly more resistant to GPU-based brute-force attacks, but admins have no way to set it as the default without modifying source code. This is particularly important for self-hosted family/team instances where users are unlikely to change their KDF settings manually.
Changes
src/config.rs— Add 4 config entries with input validation matching existing Argon2id parameter validationsrc/db/models/user.rs— Replace hardcodedCLIENT_KDF_TYPE_DEFAULT/CLIENT_KDF_ITER_DEFAULTconstants with config-backed functions. Automatically uses sensible Argon2id defaults (3 iterations, 64MB, 4 parallelism) whenCLIENT_KDF_TYPE=1src/api/core/accounts.rs— Use config values for prelogin response when email is not found (previously hardcoded to PBKDF2).env.template— Document new variablesBackwards Compatibility
Testing
Tested on a self-hosted instance with
CLIENT_KDF_TYPE=1:{"kdf": 1, "kdfIterations": 3, "kdfMemory": 64, "kdfParallelism": 4}for unknown emailsExample
That's it — sensible Argon2id defaults are applied automatically.
🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.