<p>I suggest you don't use rpcuser and password if you don't need to. If you don't set them, Bitcoin Core will use a cookie in your <code>.bitcoin</code> directory as a mean to identify you.</p>

<p>Besides <code>rpcuser</code> and <code>rpcpassword</code> are deprecated now, you're supposed to use <a href="https://github.com/bitcoin/bitcoin/tree/master/share/rpcauth" rel="nofollow noreferrer">this python script</a> to generate a password and copy the output in your config file like this : <code>rpcauth=[user]:[long random string]</code></p>

<p>But once again, I suggest you don't use it if you don't need it.</p>

<p>As for the <code>alice</code> username, it's just a common placeholder name originally used in cryptography, "Alice" and "Bob" are the two parties that try to communicate, Eve is the passive eavedropper that tries to snoop on their private conversation and Mallory is the active attacker that tampers messages or disrupts communication. I think there's no harm using it as a rpcuser name though.</p>

CC BY-SA 4.0
2021-09-08T07:47:59.037Z
can you please elaborate on this cookie in `.bitcoin/`? Where can I get more info about the filename, file contents, encoding, etc?
Michael Altfield
CC BY-SA 4.0
2022-03-11T15:39:34.120Z
The `.cookie` file is pretty straightforward, it is a plain text file that contains only a string in the form `__cookie__:<32B of randomness>`. It is automatically generated inside the datadir when Core starts.
Sosthène
CC BY-SA 4.0
2019-10-28T10:49:41.433Z
2019-10-28T10:49:41.433Z
Sosthène
<p>Every example/tutorial looks the same:</p>

<pre><code>rpcpassword=&lt;somehashofsomesort&gt; and rpcusername=rpcuser
</code></pre>

<p>They always use something like <code>rpcuser</code>, and some hash for the password. Why is it like this? Does it offer any advantage to break out of the shell and have your username and password be something you like?</p>

<p>In <a href="https://github.com/Bitcoin-ABC/bitcoin-abc/blob/master/contrib/debian/examples/bitcoin.conf" rel="nofollow noreferrer">another place</a> I found this:</p>

<pre><code>#rpcuser=alice
#rpcpassword=DONT_USE_THIS_YOU_WILL_GET_ROBBED_8ak1gI25KFTvjovL3gAM967mies3E=
</code></pre>

<p>Does setting your username to <code>alice</code> cause you to no longer be anonymous, and that's why everyone has the same username?</p>

<p>Do I even need a username and password?</p>

<authentication>
What should you set as rpcpassword and rpcusername in BitCoin?
Lance Pollard
# What should you set as rpcpassword and rpcusername in BitCoin?

(Asked by: username_0 on 2019-10-28)

Every example/tutorial looks the same:

```
rpcpassword=<somehashofsomesort> and rpcusername=rpcuser

```

They always use something like `rpcuser`, and some hash for the password. Why is it like this? Does it offer any advantage to break out of the shell and have your username and password be something you like?

In [another place](https://github.com/Bitcoin-ABC/bitcoin-abc/blob/master/contrib/debian/examples/bitcoin.conf) I found this:

```
#rpcuser=alice
#rpcpassword=DONT_USE_THIS_YOU_WILL_GET_ROBBED_8ak1gI25KFTvjovL3gAM967mies3E=

```

Does setting your username to `alice` cause you to no longer be anonymous, and that's why everyone has the same username?

Do I even need a username and password?

**Tags:** authentication


---

## 1 answers

### Answer by username_1 on 2019-10-28. Score: 4 | Accepted answer

I suggest you don't use rpcuser and password if you don't need to. If you don't set them, Bitcoin Core will use a cookie in your `.bitcoin` directory as a mean to identify you.

Besides `rpcuser` and `rpcpassword` are deprecated now, you're supposed to use [this python script](https://github.com/bitcoin/bitcoin/tree/master/share/rpcauth) to generate a password and copy the output in your config file like this : `rpcauth=[user]:[long random string]`

But once again, I suggest you don't use it if you don't need it.

As for the `alice` username, it's just a common placeholder name originally used in cryptography, "Alice" and "Bob" are the two parties that try to communicate, Eve is the passive eavedropper that tries to snoop on their private conversation and Mallory is the active attacker that tampers messages or disrupts communication. I think there's no harm using it as a rpcuser name though.

> **Comments:**
> **username_2**: can you please elaborate on this cookie in `.bitcoin/`? Where can I get more info about the filename, file contents, encoding, etc?  
> **username_1**: The `.cookie` file is pretty straightforward, it is a plain text file that contains only a string in the form `__cookie__:<32B of randomness>`. It is automatically generated inside the datadir when Core starts.  

---

