I felt it was time to move from 0.15.5 to 0.16.x
My production server is on Linux (Debian 12) I have space and recourses left on a windows server so my plan was to make myself familiar with 0.16 on that machine.
I completed the import of the snapshot created on 0.15.5
If I exit the recovery mode on windows and start with “c:\Program Files\stalwart\bin\stalwart” --config “c:\Program Files\stalwart\etc\config.json”
I can go to the portal (http://localhost:8080), and at login I get
Invalid username or password. Please try again.
I’m 100% sure I use the same details as I did with recovery mode.
Did I miss something?
I understand that topics in this category are triaged by a bot first but a human reply will follow up. If I’d prefer a human-only reply, I’ll add the no-ai tag to my topic.
The issue here is almost certainly that recovery mode uses its own special built-in credentials (set via the STALWART_RECOVERY_ADMIN environment variable), which are completely separate from the regular administrator account stored in the database. When you start Stalwart normally (without STALWART_RECOVERY_MODE=1), it authenticates against the internal directory instead, so the recovery credentials no longer work.
Here is what is likely happening and how to fix it:
Why the login fails after leaving recovery mode:
In recovery mode, authentication is handled by the STALWART_RECOVERY_ADMIN environment variable (a username:password backdoor). That credential is bypassed once the server starts normally.
After a 0.15 snapshot import, the admin account password in the database may not match what you expect, because the 0.16 internal directory is now the authentication source.
Steps to regain access:
Set the STALWART_RECOVERY_ADMIN environment variable before starting Stalwart normally (it works even outside recovery mode):
STALWART_RECOVERY_ADMIN=admin:yourChosenPassword
On Windows, you can add this via NSSM’s Environment tab for the Stalwart service, then restart.
Log in to the WebUI at http://localhost:8080 using those credentials.
Once inside, reset or verify the regular administrator account password via the WebUI so you can log in without the env variable.
RemoveSTALWART_RECOVERY_ADMIN from the environment when you are done – it is a backdoor credential and should not be left set permanently.
The docs note:
“STALWART_RECOVERY_ADMIN must not be left permanently set on a production deployment. It is a backdoor credential intended to rescue a server that has lost normal access, not a primary login.”
Also, given the architectural scope of the 0.15 to 0.16 upgrade, it is worth reviewing the official upgrade guide to ensure the snapshot import fully carried over your account data.
The credentials you used in recovery mode come from STALWART_RECOVERY_ADMIN,
which is honoured regardless of mode but only when it’s set on the running
process environment. On Windows that usually trips up between shells: if
you set it in a cmd / PowerShell session for the recovery start, it doesn’t
persist for the service that starts in normal mode, so the directory
becomes the only source of truth, and the recovery admin credentials are
silently rejected.
Two options:
Set STALWART_RECOVERY_ADMIN=admin:somepass at the system level (so it
survives a service restart) and restart Stalwart. Log in with that,
promote one of the imported directory accounts to administrator, then
remove the env var and restart again.
Log in with whatever directory account was administrator in your
0.15.5 source (its credentials migrated through with the snapshot).
Sanity check while you’re at it: confirm the snapshot import actually
wrote the principals into the new datastore (count Principal objects via
stalwart-cli).