# Hide password field on django admin dashboard **URL:** \ **Category:** The Admin\ **Created:** [April 23, 2022, 2:08pm UTC](https://forum.djangoproject.com/t/hide-password-field-on-django-admin-dashboard/13336 "2022-04-23T14:08:26Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![STProgrammer](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/stprogrammer/32/7951_2.png) [@STProgrammer](https://forum.djangoproject.com/u/STProgrammer)\ **Post date:** [April 23, 2022, 2:08pm UTC](https://forum.djangoproject.com/t/hide-password-field-on-django-admin-dashboard/13336/1 "2022-04-23T14:08:26Z")
Hi, how do I hide password field on django admin dashboard when viewing user details? But I don’t want to hide or disable password fields when adding user. ---
**Author:** ![KenWhitesell](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/kenwhitesell/32/280_2.png) [@KenWhitesell](https://forum.djangoproject.com/u/KenWhitesell)\ **Post date:** [April 23, 2022, 2:37pm UTC](https://forum.djangoproject.com/t/hide-password-field-on-django-admin-dashboard/13336/2 "2022-04-23T14:37:31Z")
Are you talking about modifying the current Django-provided ModelAdmin class for the User model? If so, you’ve got a few different options: - You can “monkey-patch” the default class - You can edit your installation’s definition of the User’s ModelAdmin class - You can create your own ModelAdmin class for User, unregister the existing class, and register your own. - You can create a proxy model for User and create a ModelAdmin class for _it_. - You could create your own views, and assign the `admin` urls for the User model to be handled by them. There are probably some other possibilities that I’m not thinking of at the moment. But generally speaking, this isn’t the best idea. I _believe_ the link allowing an admin to reset the password is part of that field, and disabling that field prevents an admin from resetting a password. ---
**Author:** ![STProgrammer](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/stprogrammer/32/7951_2.png) [@STProgrammer](https://forum.djangoproject.com/u/STProgrammer)\ **Post date:** [April 24, 2022, 2:05am UTC](https://forum.djangoproject.com/t/hide-password-field-on-django-admin-dashboard/13336/3 "2022-04-24T02:05:39Z")
The problem is not hiding the password field, but in the password field I think it shows too much sensitive information like hash, salt, nr of iterations etc. I want to hide these information. ---
**Author:** ![KenWhitesell](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/kenwhitesell/32/280_2.png) [@KenWhitesell](https://forum.djangoproject.com/u/KenWhitesell)\ **Post date:** [April 24, 2022, 2:40am UTC](https://forum.djangoproject.com/t/hide-password-field-on-django-admin-dashboard/13336/4 "2022-04-24T02:40:55Z")
It does not show either the complete salt or the complete hash. I would make the very reasonable assumption in this case that the information disclosed does not present a security vulnerability for those having access to that page. If you’ve got people looking at _that_ page who wouldn’t otherwise have access to that information, then you’re probably exposing that page to people who shouldn’t be seeing it. ---
**Author:** ![STProgrammer](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/stprogrammer/32/7951_2.png) [@STProgrammer](https://forum.djangoproject.com/u/STProgrammer)\ **Post date:** [April 24, 2022, 12:40pm UTC](https://forum.djangoproject.com/t/hide-password-field-on-django-admin-dashboard/13336/5 "2022-04-24T12:40:34Z")
People who can view that page are staff users (or administrators). They are not owners of the system, but just staff users who manage other users and objects. ---
**Author:** ![Rigo-Villalta](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/rigo-villalta/32/5667_2.png) [@Rigo-Villalta](https://forum.djangoproject.com/u/Rigo-Villalta)\ **Post date:** [April 25, 2022, 2:38am UTC](https://forum.djangoproject.com/t/hide-password-field-on-django-admin-dashboard/13336/6 "2022-04-25T02:38:21Z")
Hello @STProgrammer I think there are several places to achieve what you are looking for, I have no test any of them, but a couple could be(some of them are mentioned implicit and briefly by @KenWhitesell : 1. instantiate [Django User Admin](https://github.com/django/django/blob/ed0a2c3238aa0b9c0d01c436d5bcd70930d696b0/django/contrib/auth/admin.py#L44) and override the fieldsets and remove “password” you can copy and paste al the other fieldsets, your code should look like this: ```auto form django.contrib.auth.admin import UserAdmin @admin.register(User) class CustomUserAdmin(UserAdmin): fieldsets = ( (None, {"fields": ("username")}), (_("Personal info"), {"fields": ("first_name", "last_name", "email")}), ( _("Permissions"), { "fields": ( "is_active", "is_staff", "is_superuser", "groups", "user_permissions", ), }, ), (_("Important dates"), {"fields": ("last_login", "date_joined")}), ) ``` If you want to link the form to change the user’s password you can [create a custom model admin field](https://docs.djangoproject.com/en/4.0/ref/contrib/admin/#django.contrib.admin.ModelAdmin.readonly_fields), reversing the url to the [“User Password Change View”](https://docs.djangoproject.com/en/4.0/ref/contrib/admin/#reversing-admin-urls) of Django admin You will finish with a link without any hash. 1. You can instantiate several parts of the UserAdmin class, the [UserChangeForm](https://github.com/django/django/blob/ed0a2c3238aa0b9c0d01c436d5bcd70930d696b0/django/contrib/auth/forms.py#L147) should have a instance of ReadOnlyPasswordHashField as “password” property, and this should have a instance of [ReadOnlyPasswordHashWidget](https://github.com/django/django/blob/ed0a2c3238aa0b9c0d01c436d5bcd70930d696b0/django/contrib/auth/forms.py#L33) as “widget” property. I think this approach is more complicate and touch many parte of the class. Other options could include create your own UserChangeForm without the password field or even hide the hash at Javascript level, this could only be at UI level, but as @KenWhitesell mentions, the information displayed is not a security hole, so the last option could be the easier one and achive your goal with a couple of lines of code. I hope it helps.