Introduction

The requirepass directive enables password authentication for Redis clients.

Without authentication, anyone who can connect to your Redis server can execute commands, modify data, or even delete the entire database.

Although modern Redis versions recommend Access Control Lists (ACLs) for more advanced security, requirepass remains a simple and effective way to protect many Redis deployments.

This guide explains how requirepass works, how to configure it, and when it should be used.

Default Value

By default, password authentication is disabled.

requirepass foobared

Since the directive is commented out, Redis accepts client connections without requiring a password.

Syntax

requirepass your_secure_password

Example:

requirepass MyStrongPassword123!

Choose a long, random password that is difficult to guess.

Why Is requirepass Important?

Redis is designed for trusted internal networks.

If a Redis server is accidentally exposed to the public Internet without authentication, attackers may be able to:

Read sensitive data.

Modify cached information.

Delete databases.

Execute administrative commands.

Cause denial-of-service conditions.

Enabling authentication is one of the first steps in securing a Redis server.

Configure Password Authentication

Open the Redis configuration file.

sudo nano /etc/redis.conf

Locate the following line.

requirepass foobared

Replace it with:

requirepass MyStrongPassword123!

Save the file and restart Redis.

sudo systemctl restart redis

Connect Using a Password

Without authentication:

redis-cli

Running commands will return an authentication error.

NOAUTH Authentication required.

Connect with a password.

redis-cli -a MyStrongPassword123!

Or authenticate after connecting.

AUTH MyStrongPassword123!

Redis responds:

OK

Verify the Configuration

Run:

redis-cli CONFIG GET requirepass

Redis does not display the actual password for security reasons.

Instead, verify authentication by connecting without a password and confirming that Redis returns:

NOAUTH Authentication required.

requirepass vs ACL

| Feature                         | requirepass | ACL      |
| ------------------------------- | ----------- | -------- |
| Number of users                 | One         | Multiple |
| Password support                | Yes         | Yes      |
| Permission control              | No          | Yes      |
| Command restrictions            | No          | Yes      |
| Recommended for new deployments | Limited     | Yes      |

ACLs provide more granular security, but requirepass is still sufficient for many small or internal deployments.

Common Mistakes

Using Weak Passwords

Simple passwords can be guessed through brute-force attacks.

Always use a long, random password.

Exposing Redis to the Internet

Authentication alone should not be your only protection.

Restrict network access whenever possible.

Forgetting Client Configuration

Applications connecting to Redis must also be updated with the new password.

Otherwise, authentication failures will occur.

Best Practices

Enable password authentication for all production servers.

Combine requirepass with the bind directive.

Use a firewall to limit network access.

Avoid exposing Redis directly to the public Internet.

Rotate passwords periodically.

Consider migrating to ACLs for larger deployments.

Related Articles

Redis Explained

Redis bind Explained

Redis maxmemory Explained

Redis appendonly Explained

Redis ACL Explained

Conclusion

The requirepass directive provides a simple way to protect Redis from unauthorized access by requiring clients to authenticate before executing commands. While newer Redis versions recommend ACLs for more advanced access control, requirepass remains an effective security measure for many environments.

For production deployments, password authentication should always be combined with proper network restrictions, firewall rules, and regular security updates to provide comprehensive protection.