# Update to Bitwarden 2023.2.0 - Argon2 Encryption

**URL:** <https://vaultwarden.discourse.group/t/update-to-bitwarden-2023-2-0-argon2-encryption/2446>\
**Category:** Feature Requests\
**Created:** [March 7, 2023, 1:42pm UTC](https://vaultwarden.discourse.group/t/update-to-bitwarden-2023-2-0-argon2-encryption/2446 "2023-03-07T13:42:52Z")\
**Posts on this page:** 16\
**Page:** 1

<div class="post-metadata">

**Author:** ![WUS9Xw29jbtJowx](https://avatars.discourse-cdn.com/v4/letter/w/edb3f5/32.png) [@WUS9Xw29jbtJowx](https://vaultwarden.discourse.group/u/WUS9Xw29jbtJowx)\
**Post date:** [March 7, 2023, 1:42pm UTC](https://vaultwarden.discourse.group/t/update-to-bitwarden-2023-2-0-argon2-encryption/2446/1 "2023-03-07T13:42:52Z")

</div>

Hello,

I’ve seen Bitwarden finally implemented Argon2:

> **[Release Version 2023.2.0 · bitwarden/server](https://github.com/bitwarden/server/releases/tag/v2023.2.0)**
>
> New automatic license sync option for self-hosted organizations to quickly update billing and subscription changes
> Bug fix for enabling Single Organization Policy with revoked users
> Bug fix for inv...

> **[Release Web v2023.2.0 · bitwarden/clients](https://github.com/bitwarden/clients/releases/tag/web-v2023.2.0)**
>
> Organization administration tabs have been restructured to provide easier management between collections, members, and groups, with a consolidated Vault view and new Members and Groups tabs
> Adjust ...

When do you think it is possible to Upgrade Vaultwarden to Version 2023.2.0?

---

<div class="post-metadata">

**Author:** ![BlackDex](https://yyz2.discourse-cdn.com/free1/user_avatar/vaultwarden.discourse.group/blackdex/32/8_2.png) [@BlackDex](https://vaultwarden.discourse.group/u/BlackDex)\
**Post date:** [March 7, 2023, 6:08pm UTC](https://vaultwarden.discourse.group/t/update-to-bitwarden-2023-2-0-argon2-encryption/2446/2 "2023-03-07T18:08:46Z")

</div>

Use testing, those images have it already

---

<div class="post-metadata">

**Author:** ![WUS9Xw29jbtJowx](https://avatars.discourse-cdn.com/v4/letter/w/edb3f5/32.png) [@WUS9Xw29jbtJowx](https://vaultwarden.discourse.group/u/WUS9Xw29jbtJowx)\
**Post date:** [March 7, 2023, 6:57pm UTC](https://vaultwarden.discourse.group/t/update-to-bitwarden-2023-2-0-argon2-encryption/2446/3 "2023-03-07T18:57:03Z")

</div>

Oh cool, I didn’t know that, thank you.

I just noticed when I changed my Admin-Token a Argon2id PHC String, there was the following Messages, that doesn’t seem normal, right?

WARNING: The argon2id variable is not set. Defaulting to a blank string.  
WARNING: The v variable is not set. Defaulting to a blank string.  
WARNING: The m variable is not set. Defaulting to a blank string.  
WARNING: The %PHC-String Part 1% variable is not set. Defaulting to a blank string.  
WARNING: The %PHC-String Part 2% variable is not set. Defaulting to a blank string.

---

<div class="post-metadata">

**Author:** ![stefan0xC](https://yyz2.discourse-cdn.com/free1/user_avatar/vaultwarden.discourse.group/stefan0xc/32/1765_2.png) [@stefan0xC](https://vaultwarden.discourse.group/u/stefan0xC)\
**Post date:** [March 7, 2023, 10:56pm UTC](https://vaultwarden.discourse.group/t/update-to-bitwarden-2023-2-0-argon2-encryption/2446/4 "2023-03-07T22:56:23Z")

</div>

From the [compose file specification](https://docs.docker.com/compose/compose-file/#interpolation):

> You can use a `$$` (double-dollar sign) when your configuration needs a literal dollar sign. This also prevents Compose from interpolating a value, so a `$$` allows you to refer to environment variables that you don’t want processed by Compose.

So it seems like it’s necessary to escape the `$` for docker-compose.

---

<div class="post-metadata">

**Author:** ![WUS9Xw29jbtJowx](https://avatars.discourse-cdn.com/v4/letter/w/edb3f5/32.png) [@WUS9Xw29jbtJowx](https://vaultwarden.discourse.group/u/WUS9Xw29jbtJowx)\
**Post date:** [March 8, 2023, 7:17am UTC](https://vaultwarden.discourse.group/t/update-to-bitwarden-2023-2-0-argon2-encryption/2446/5 "2023-03-08T07:17:57Z")

</div>

Alright, thank you, that worked. 🙂

---

<div class="post-metadata">

**Author:** ![BlackDex](https://yyz2.discourse-cdn.com/free1/user_avatar/vaultwarden.discourse.group/blackdex/32/8_2.png) [@BlackDex](https://vaultwarden.discourse.group/u/BlackDex)\
**Post date:** [March 8, 2023, 7:22pm UTC](https://vaultwarden.discourse.group/t/update-to-bitwarden-2023-2-0-argon2-encryption/2446/6 "2023-03-08T19:22:54Z")

</div>

Or, use single quotes around the value that should also fix it.

---

<div class="post-metadata">

**Author:** ![stefan0xC](https://yyz2.discourse-cdn.com/free1/user_avatar/vaultwarden.discourse.group/stefan0xc/32/1765_2.png) [@stefan0xC](https://vaultwarden.discourse.group/u/stefan0xC)\
**Post date:** [March 8, 2023, 7:47pm UTC](https://vaultwarden.discourse.group/t/update-to-bitwarden-2023-2-0-argon2-encryption/2446/7 "2023-03-08T19:47:33Z")

</div>

> [@BlackDex](#):
>
> Or, use single quotes around the value that should also fix it.

I’ve tested it and I don’t think it’s enough:

```auto
root@host:/srv/test# cat docker-compose.yml 
version: "3"
services:
  test:
    image: alpine:latest
    command: printenv
    environment:
      - ADMIN_TOKEN='$argon2id$v=19$m=65540,t=3,p=4$HAexz76Lr3erFhweyNIQXt7KJcPdXLACxotExVPfxLs$i+NhxlBJib62TL+NtSzn0ZizrmtXsbirfX+/PxNI2mY'

```

```auto
root@host:/srv/test# docker-compose up
WARNING: The argon2id variable is not set. Defaulting to a blank string.
WARNING: The v variable is not set. Defaulting to a blank string.
WARNING: The m variable is not set. Defaulting to a blank string.
WARNING: The HAexz76Lr3erFhweyNIQXt7KJcPdXLACxotExVPfxLs variable is not set. Defaulting to a blank string.
WARNING: The i variable is not set. Defaulting to a blank string.
Starting test_test_1 ... done
Attaching to test_test_1
test_1 | PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
test_1 | HOSTNAME=2926c1079e20
test_1 | ADMIN_TOKEN='=19=65540,t=3,p=4+NhxlBJib62TL+NtSzn0ZizrmtXsbirfX+/PxNI2mY'
test_1 | HOME=/root
test_test_1 exited with code 0

```

It only works as expected when setting the value in an `env_file`.

---

<div class="post-metadata">

**Author:** ![BlackDex](https://yyz2.discourse-cdn.com/free1/user_avatar/vaultwarden.discourse.group/blackdex/32/8_2.png) [@BlackDex](https://vaultwarden.discourse.group/u/BlackDex)\
**Post date:** [March 8, 2023, 8:05pm UTC](https://vaultwarden.discourse.group/t/update-to-bitwarden-2023-2-0-argon2-encryption/2446/8 "2023-03-08T20:05:13Z")

</div>

Ah, yes i have it in an .env file which is used by docker-compose.  
There it works indeed. Same goes for the .env file Vaultwarden uses it self.

Compose files have some strange ways of working indeed.

---

<div class="post-metadata">

**Author:** ![BlackDex](https://yyz2.discourse-cdn.com/free1/user_avatar/vaultwarden.discourse.group/blackdex/32/8_2.png) [@BlackDex](https://vaultwarden.discourse.group/u/BlackDex)\
**Post date:** [March 8, 2023, 8:07pm UTC](https://vaultwarden.discourse.group/t/update-to-bitwarden-2023-2-0-argon2-encryption/2446/9 "2023-03-08T20:07:19Z")

</div>

Ow, what about fully putting the variable within quotes. Like…

```yaml
 - 'ADMIN_TOKEN=$argon2id$....'

```

---

<div class="post-metadata">

**Author:** ![stefan0xC](https://yyz2.discourse-cdn.com/free1/user_avatar/vaultwarden.discourse.group/stefan0xc/32/1765_2.png) [@stefan0xC](https://vaultwarden.discourse.group/u/stefan0xC)\
**Post date:** [March 8, 2023, 8:10pm UTC](https://vaultwarden.discourse.group/t/update-to-bitwarden-2023-2-0-argon2-encryption/2446/10 "2023-03-08T20:10:08Z")

</div>

> [@BlackDex](#):
>
> what about fully putting the variable within quotes

Because of variable interpolation (which I linked above) it does not make a difference. 😕

---

<div class="post-metadata">

**Author:** ![stefan0xC](https://yyz2.discourse-cdn.com/free1/user_avatar/vaultwarden.discourse.group/stefan0xc/32/1765_2.png) [@stefan0xC](https://vaultwarden.discourse.group/u/stefan0xC)\
**Post date:** [March 8, 2023, 8:11pm UTC](https://vaultwarden.discourse.group/t/update-to-bitwarden-2023-2-0-argon2-encryption/2446/11 "2023-03-08T20:11:35Z")

</div>

So I think we should probably add a notice to the wiki as more people will run into that issue.

---

<div class="post-metadata">

**Author:** ![BlackDex](https://yyz2.discourse-cdn.com/free1/user_avatar/vaultwarden.discourse.group/blackdex/32/8_2.png) [@BlackDex](https://vaultwarden.discourse.group/u/BlackDex)\
**Post date:** [March 8, 2023, 8:12pm UTC](https://vaultwarden.discourse.group/t/update-to-bitwarden-2023-2-0-argon2-encryption/2446/12 "2023-03-08T20:12:38Z")

</div>

Have you tried it?  
It is handled differently i thought.

---

<div class="post-metadata">

**Author:** ![stefan0xC](https://yyz2.discourse-cdn.com/free1/user_avatar/vaultwarden.discourse.group/stefan0xc/32/1765_2.png) [@stefan0xC](https://vaultwarden.discourse.group/u/stefan0xC)\
**Post date:** [March 8, 2023, 8:15pm UTC](https://vaultwarden.discourse.group/t/update-to-bitwarden-2023-2-0-argon2-encryption/2446/13 "2023-03-08T20:15:03Z")

</div>

Same warning messages but the value is set to

```auto
ADMIN_TOKEN==19=65540,t=3,p=4+NhxlBJib62TL+NtSzn0ZizrmtXsbirfX+/PxNI2mY

```

---

<div class="post-metadata">

**Author:** ![BlackDex](https://yyz2.discourse-cdn.com/free1/user_avatar/vaultwarden.discourse.group/blackdex/32/8_2.png) [@BlackDex](https://vaultwarden.discourse.group/u/BlackDex)\
**Post date:** [March 8, 2023, 8:21pm UTC](https://vaultwarden.discourse.group/t/update-to-bitwarden-2023-2-0-argon2-encryption/2446/14 "2023-03-08T20:21:08Z")

</div>

Hmm, yea i see.  
Adding some info for this is probably a good idea 🙂

---

<div class="post-metadata">

**Author:** ![crespire](https://yyz2.discourse-cdn.com/free1/user_avatar/vaultwarden.discourse.group/crespire/32/942_2.png) [@crespire](https://vaultwarden.discourse.group/u/crespire)\
**Post date:** [March 10, 2023, 2:43am UTC](https://vaultwarden.discourse.group/t/update-to-bitwarden-2023-2-0-argon2-encryption/2446/15 "2023-03-10T02:43:19Z")

</div>

Do you know when this might graduate to the `latest` image?

---

<div class="post-metadata">

**Author:** ![BlackDex](https://yyz2.discourse-cdn.com/free1/user_avatar/vaultwarden.discourse.group/blackdex/32/8_2.png) [@BlackDex](https://vaultwarden.discourse.group/u/BlackDex)\
**Post date:** [March 10, 2023, 5:34am UTC](https://vaultwarden.discourse.group/t/update-to-bitwarden-2023-2-0-argon2-encryption/2446/16 "2023-03-10T05:34:02Z")

</div>

There is no specific release schedule. So no.
