Currently we always regenerate the 2FA Remember token, and always send that back to the client. This is not the correct way, and in turn causes the remember token to never expire.
While this might be convenient, it is not really safe. This commit changes the 2FA Remember Tokens from random string to a JWT. This JWT has a lifetime of 30 days and is validated per device & user combination.
This does mean that once this commit is merged, and users are using this version, all their remember tokens will be invalidated. From my point of view this isn't a bad thing, since those tokens should have expired already.
Only users who recently checked the remember checkbox within 30 days have to login again, but that is a minor inconvenience I think.
🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.
## 📋 Pull Request Information
**Original PR:** https://github.com/dani-garcia/vaultwarden/pull/6929
**Author:** [@BlackDex](https://github.com/BlackDex)
**Created:** 3/11/2026
**Status:** ✅ Merged
**Merged:** 3/23/2026
**Merged by:** [@dani-garcia](https://github.com/dani-garcia)
**Base:** `main` ← **Head:** `fix-2fa-remember`
---
### 📝 Commits (1)
- [`d785a25`](https://github.com/dani-garcia/vaultwarden/commit/d785a2594114000e3e9fcc469cdcc7e1da388f09) Fix 2FA Remember to actually be 30 days
### 📊 Changes
**3 files changed** (+52 additions, -10 deletions)
<details>
<summary>View changed files</summary>
📝 `src/api/identity.rs` (+15 -6)
📝 `src/auth.rs` (+30 -0)
📝 `src/db/models/device.rs` (+7 -4)
</details>
### 📄 Description
Currently we always regenerate the 2FA Remember token, and always send that back to the client. This is not the correct way, and in turn causes the remember token to never expire.
While this might be convenient, it is not really safe. This commit changes the 2FA Remember Tokens from random string to a JWT. This JWT has a lifetime of 30 days and is validated per device & user combination.
This does mean that once this commit is merged, and users are using this version, all their remember tokens will be invalidated. From my point of view this isn't a bad thing, since those tokens should have expired already.
Only users who recently checked the remember checkbox within 30 days have to login again, but that is a minor inconvenience I think.
---
<sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
📋 Pull Request Information
Original PR: https://github.com/dani-garcia/vaultwarden/pull/6929
Author: @BlackDex
Created: 3/11/2026
Status: ✅ Merged
Merged: 3/23/2026
Merged by: @dani-garcia
Base:
main← Head:fix-2fa-remember📝 Commits (1)
d785a25Fix 2FA Remember to actually be 30 days📊 Changes
3 files changed (+52 additions, -10 deletions)
View changed files
📝
src/api/identity.rs(+15 -6)📝
src/auth.rs(+30 -0)📝
src/db/models/device.rs(+7 -4)📄 Description
Currently we always regenerate the 2FA Remember token, and always send that back to the client. This is not the correct way, and in turn causes the remember token to never expire.
While this might be convenient, it is not really safe. This commit changes the 2FA Remember Tokens from random string to a JWT. This JWT has a lifetime of 30 days and is validated per device & user combination.
This does mean that once this commit is merged, and users are using this version, all their remember tokens will be invalidated. From my point of view this isn't a bad thing, since those tokens should have expired already.
Only users who recently checked the remember checkbox within 30 days have to login again, but that is a minor inconvenience I think.
🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.