Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteiTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
Uptime Kuma does not currently provide a dependable, built-in multi-user administration system. The documented setup creates one local account during initial configuration. There is no established native workflow for adding additional accounts, assigning roles, or limiting a person to particular monitors. If several people need access, do not assume that sharing the administrator password provides accountability or least privilege. Instead, secure the single Kuma account carefully, identify the exact version you run, and evaluate an external authentication layer or a separate instance as an operational workaround.
What user management means in Uptime Kuma today
Uptime Kuma is self-hosted monitoring software. In the documented installation model, you start the web application, open it in a browser, and create one local account during the first-run setup. That account is the identity Kuma uses for the application. The normal setup does not establish a directory of users from which you can invite colleagues or assign permissions.
Project issue reports describe this limitation directly. Issue #7203 requests basic user management, while older issues #128 and #2143 describe teams sharing one account because separate users and session control were unavailable. Those reports document the product state represented by the relevant versions; behavior can change, so confirm the release you deploy before relying on any security workflow.
In practical terms, the following capabilities should be treated as unavailable unless your exact build independently proves otherwise:
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
- Adding a second local Kuma account from an administration page.
- Roles such as viewer, operator, and administrator.
- Per-monitor ownership or permissions.
- An audit trail that attributes an edit to an individual person.
- Built-in LDAP, Active Directory, SSO, or a BetterAuth-backed identity directory.
Requests for roles, LDAP, group filtering, role mapping, and external providers remain prospective directions in project issues #6200 and #5359. They are not proof of a shipped integration.
Confirm your version and deployment before changing access
Instructions that are correct for one Uptime Kuma release may not apply to another. Record the exact image tag, package version, and deployment method before you alter authentication or upgrade the service.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11- Identify the deployment type. The official project documents Docker deployment with the
louislam/uptime-kumaimage. If you use Docker Compose, keep the compose file and its image tag with your operational records. - Record the image actually running. For a Docker container, replace
kumawith your container name indocker inspect --format '{{.Config.Image}}' kuma. This reports the image reference, including a tag when one was specified. - Check the application endpoint. The installation documentation exposes the web application on port
3001. A typical internal URL ishttp://server-name:3001; use your own host name and the TLS URL supplied by your reverse proxy if one is present. - Make a backup before an upgrade. The application data directory is
/app/datainside the container. Confirm where that directory is mounted on the host and that a recent backup can actually be restored. - Test in a maintenance window. If you put an identity proxy in front of Kuma, test sign-in, sign-out, monitor editing, notifications, and recovery while the current local login remains available to an authorized operator.
Do not infer support for a Users page merely because a menu with a similar name appears in a fork, a plug-in, or a newer build. Check the release notes and the behavior of the version you are deploying.
Creating the initial Uptime Kuma account
The first-run account is the one documented local identity. The exact wizard wording can vary by release, but the safe sequence is consistent:
- Start the Kuma service with persistent storage mounted to
/app/data. - Open the service on its configured host and port, normally port
3001unless your proxy maps it elsewhere. - Complete the initial setup form and create a long, unique password. Do not reuse a password from your operating system, cloud account, or source-control service.
- Sign in and create a recovery record in your organization’s password manager. Limit access to that record to the people who are responsible for the monitoring service.
- If your particular release presents a two-factor-authentication option, enroll it and store the recovery material according to your organization’s incident procedure. The internal authentication documentation allows a two-factor token with a login request, but that does not by itself establish identical UI behavior in every release.
After setup, you may see monitor, notification, status-page, and general configuration controls. Their presence does not mean that a second user can be added. If no user-management control is documented for your version, assume that the account you created is the only local account.
Why you should not look for a built-in Users page
A common instruction on older tutorials is to open a settings area and add users. The project records supplied for this topic do not establish such a shipped workflow. Issue #7203 is an open request for basic user management, including the ability for one person to add monitors without changing or deleting another person’s monitors. A requested design is not the same as an available feature.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Do not create a fictitious path such as Settings > Users in your runbook. If a version you operate does expose a user screen, verify its release, test its permission behavior, and document the result separately. Until that verification exists, plan on one local identity with broad control of the instance.
Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
What sharing one administrator login does and does not provide
Giving several operators the same username and password can let them reach the dashboard, but it does not create separate identities. Kuma cannot reliably tell which human changed a monitor when all sessions use the same account. Password rotation also becomes disruptive: every person must receive the new secret, and an ex-employee may retain a copy unless every location is audited.
Shared credentials also defeat least privilege. Anyone who can sign in with the account can generally perform the same class of actions as the account owner, including changing monitors, notifications, and other instance settings. A reverse proxy may record which external identity reached the application, but Kuma itself will still see the local account unless a verified, version-specific integration maps identities inside the application.
For a small team that must continue with one account, establish compensating controls:
- Store the password in a managed vault rather than chat, email, or a shared document.
- Restrict who can retrieve the secret and review that membership periodically.
- Use HTTPS and limit direct access to port
3001; expose Kuma through a controlled network path. - Keep a change record outside Kuma that includes the operator, time, monitor, and reason for each material edit.
- Back up the data directory before upgrades and significant configuration changes.
- Define an emergency owner who can rotate the password and restore a known-good backup.
Compare the practical access patterns
The following comparison separates what Kuma documents natively from arrangements you can operate around it. “Not established” means the project records do not demonstrate that capability as a shipped feature.
| Approach | Separate identities | Least privilege or per-monitor control | Compatibility | Auditability | Recovery if identity service fails |
|---|---|---|---|---|---|
| One native local account | No; everyone uses the same identity. | No native role or per-monitor model is established. | Highest, because it is the documented setup. | Low inside Kuma; edits cannot be attributed to a person. | Does not depend on an external identity service; protect the local credential. |
| Reverse proxy or external access gate | The gate may recognize individuals, but Kuma still receives its local account unless a supported integration exists. | Usually no inside Kuma; the gate controls entry, not monitor ownership. | Must be validated against the exact Kuma release and proxy configuration. | Potentially better at the gateway; application-level attribution remains limited. | Requires a tested local emergency path or a documented bypass procedure. |
| Prospective LDAP, SSO, or BetterAuth integration | Potentially, if a compatible implementation is actually installed. | Role mapping is not established by the project records. | Unknown until the implementation and release are tested. | Depends on both systems and their log retention. | Requires a local fallback and a recovery plan; do not assume one exists. |
| Separate Kuma instances | Each instance can have its own local account, but identities are separated by instance rather than shared in one dashboard. | Isolation can reduce the scope of an account, but it is not per-monitor authorization within one instance. | Operationally simple in principle, but every instance must be maintained and backed up. | Changes are separated by instance, not necessarily by person. | Each instance has its own recovery process and data store. |
Choose an approach based on the people who need access, the number of monitors, and the consequence of an incorrect change. Do not advertise an external gate as full role-based access unless you have tested both the gate and the Kuma actions it protects.
Using a reverse proxy or external identity layer safely
An external layer can improve control over who reaches the Kuma URL, but it does not automatically turn Kuma into a multi-user application. Treat it as an access boundary and document exactly what it does.
1. Keep Kuma on a restricted network path
Bind or firewall the service so that ordinary users cannot bypass the proxy and connect directly to port 3001. The proxy should terminate HTTPS and forward only the traffic required by Kuma. Because the browser client uses Socket.IO authentication, confirm that the proxy supports the required WebSocket or Socket.IO upgrade behavior; a page that loads while live status updates fail is a common sign of incomplete forwarding.
Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
2. Decide how the local account is handled
An access gate can require an employee’s identity before allowing the request through, but the Kuma application may still receive one shared local login. Decide whether operators will enter that credential manually, whether an approved automation mechanism supplies it, or whether the gate is only an additional perimeter control. Never claim that the gateway has created Kuma users unless the release provides a documented identity mapping.
3. Preserve an emergency path
Document how an authorized administrator reaches the local account if the identity provider, DNS, proxy, or network link is unavailable. Store that procedure offline or in a separately protected system. Test it during a maintenance window; an untested fallback is not a recovery plan.
4. Check logout, session expiry, and revocation
Verify what happens when a person leaves the organization or loses access to the identity provider. Revoking the external identity may stop new requests while an existing Kuma session remains valid. Set and test session expiration at the layer that owns the session, and rotate the shared local password when membership changes.
5. Keep two audit records
Retain the proxy or identity-provider log for the human identity and a separate Kuma change record for the monitor or setting that changed. The two records can be correlated by time, but they are not the same audit trail.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →LDAP, SSO, roles, and BetterAuth: how to describe them accurately
It is reasonable to ask whether Kuma supports LDAP, Active Directory, SSO, or BetterAuth. The project issue history shows sustained demand for these capabilities, including LDAP group filtering and role mapping in issue #5359 and questions about BetterAuth, multi-user support, and roles in issue #6200. Those discussions identify requested or prospective directions, not a guaranteed integration in the release you installed.
Before adopting an identity connector, require all of the following from its documentation and test environment:
- The exact Kuma version and connector version it supports.
- Whether it creates independent Kuma identities or merely protects the URL.
- How groups map to permissions, if any mapping exists.
- Whether a local administrator fallback remains available.
- How two-factor authentication, logout, password resets, and account disabling work.
- How monitor changes are attributed and how long logs are retained.
- What happens when the directory or identity provider is unavailable.
If a connector cannot answer these questions, describe it as an external access experiment, not as native Uptime Kuma user management.
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
Do not build a production user system on the internal API
Uptime Kuma’s internal API documentation describes Socket.IO authentication. A client connects and sends a login event containing a username and password, optionally with a two-factor token. A client can also use loginByToken with a token obtained after a successful login when Remember Me was selected.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →The same documentation warns that this is an internal API, is not officially supported for third-party integrations, and may change without notice. That makes it unsuitable as the foundation for a custom user directory, role mapper, or password-sharing service. If you automate a task, isolate the automation account, protect any token as a credential, and expect to retest it after upgrades. Do not expose Socket.IO authentication directly to the public internet.
Protect the Docker data directory and SQLite database
Authentication decisions are not useful if the instance loses its account and monitor data. The installation documentation persists /app/data so that configuration survives container replacement. A deployment that leaves this path inside an ephemeral container can lose the local account, monitors, notification settings, and history when the container is recreated.
Persistence checklist
- Map a durable host or volume path to
/app/data. - Restrict filesystem permissions so only the container and authorized operators can read the data.
- Back up the directory using a method that produces a consistent copy.
- Keep at least one tested restore copy separate from the host running Kuma.
- Use storage that supports POSIX file locks. The installation wiki warns that the locks are needed to avoid SQLite corruption.
- Be cautious with network filesystems or backup tools that do not preserve locking semantics.
Before an upgrade
- Record the current image tag and configuration.
- Stop or quiesce the container according to your backup procedure so the SQLite files are copied consistently.
- Back up
/app/dataand verify that the archive can be read. - Upgrade in a test or maintenance window, then sign in with the existing local account.
- Confirm monitors, notification channels, status pages, and any access proxy before declaring the upgrade complete.
Never delete the data directory as a first response to a forgotten password or a missing menu. Doing so can destroy the only copy of your monitoring configuration.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Troubleshooting common user-access problems
There is no Users or Roles menu
That is the expected result for the documented single-account model. Confirm the version, then stop looking for a hidden permission. Use the compensating controls above or evaluate an external access boundary.
Recommended Free Tools
Several operators keep overwriting one another’s monitors
The shared identity provides no ownership boundary. Introduce an external change record, restrict who can edit the instance, and establish an approval process. A proxy alone will not prevent a permitted Kuma session from editing another person’s monitor.
The proxy login works, but the dashboard is stale or actions fail
Check that the proxy forwards the WebSocket or Socket.IO connection as well as ordinary HTTP requests. Then test with a fresh browser session and verify that direct access to port 3001 is blocked if the proxy is meant to be mandatory.
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
An identity provider outage locks everyone out
Use the documented local account through the tested emergency path. If no such path exists, treat that as an availability gap and create one before making the external gate mandatory. Keep recovery credentials separate from the identity system they are intended to recover.
A token-based script stopped working after an upgrade
The internal API is explicitly subject to change. Recheck the deployed version, review the current project documentation, rotate the affected token, and decide whether the automation is important enough to justify a maintained integration. Avoid silently falling back to a shared password in an unreviewed script.
The database reports corruption after moving storage
Review whether the new filesystem honors POSIX locks and whether more than one process or container accessed the same SQLite files. Restore the last consistent backup rather than copying a live, partially written database over the original.
A maintainable operating procedure for teams
Until native multi-user support is established for your release, write a short procedure that makes the limitation explicit:
- Name the accountable owner of the Kuma instance.
- List the people authorized to retrieve the local credential or pass the external access gate.
- Record every monitor and notification change in a ticket or change log.
- Review access membership and the password-manager entry on a fixed schedule and whenever someone leaves.
- Test backup restoration and the emergency login path at a defined interval.
- Pin and record the Kuma version before upgrades, then repeat the authentication and proxy tests afterward.
- Reassess the design if the team needs per-person audit trails, delegated administration, or monitor-level permissions; those requirements exceed the documented native model.
This procedure does not manufacture roles inside Kuma. It makes the operational consequences of a single local account visible and gives the team a way to control them.
Bottom line for administrators
For the documented Uptime Kuma setup, create one carefully protected local account and assume it is the only native identity. Do not promise colleagues separate accounts, roles, LDAP, SSO, BetterAuth, or per-monitor permissions without verifying the exact release and integration. If the organization needs individual accountability, place Kuma behind a tested external access layer or isolate workloads into separate instances, while preserving a secure local recovery path and durable, lock-safe storage for /app/data.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
