Released: May 25, 2026

Updates in 2.19.0

Features

• Added support for Argon2 password hashing. Argon2 is a memory-hard algorithm significantly more resistant to brute-force attacks than SHA-2, at the cost of higher memory and CPU usage per login. Enable it by setting users.passwordHashAlgorithm: { type: argon2id } in config.yaml. Argon2 parameters such as memory cost and parallelism can be configured explicitly.
• Extended users.passwordHashAlgorithm in config.yaml to accept an object form ({ type: argon2id }, { type: SHA512, saltLength: 20 }) in addition to the existing string form (SHA512). The string form remains supported.
• Added --password-hash option to burusftp user update command (mirrors the existing option in burusftp user add).
• Web Admin: Added "Add new user" button to the users toolbar.
• Web Admin: Added Save button to the breadcrumb bar on selected pages.

Fixes

• Web Admin: Fixed breadcrumbs on the Protection and FTP settings pages.