---
title: "Securing the Install Tool"
manual: "TYPO3 Explained"
version: "14.3"
permalink: "https://docs.typo3.org/permalink/t3coreapi:security-install-tool@14.3"
source: "Security/GuidelinesIntegrators/InstallTool.rst"
rendered: "2026-10-01T15:20:05+00:00"
---

# Securing the Install Tool {#security-install-tool}

The Install Tool allows you to configure the TYPO3 system on a very
low level, which means, not only the basic settings but also the most
essential settings can be changed.

## Enabling and accessing the Install Tool {#security-install-tool-access}

### How Install Tool access is protected {#security-install-tool-access-intro}

A TYPO3 backend account is not required in order to access the Install
Tool, so it is clear that the Install Tool requires some special attention
(and protection).

TYPO3 comes with a two-step mechanism out-of-the-box to protect the
Install Tool against unauthorized access:

1.  The [`ENABLE_INSTALL_TOOL`](../../Administration/DirectoryStructure/FlagFiles.md#file-config-enable-install-tool) file must exist in order for the Install
    Tool to be accessible.
1.  An Install Tool password is required. This password is independent of
    all backend user passwords.

The Install Tool can be found as a stand-alone application via
`https://example.org/typo3/install`. The path follows the
[backend entry point](https://docs.typo3.org/permalink/t3coreapi:backend-entry-point@14.3), for example
`https://example.org/admin/install`. It is also
[accessible in the backend](https://docs.typo3.org/permalink/t3coreapi:security-install-tool-backend-access@14.3), but
only for logged-in users with administrator and maintainer privileges.

### The [`ENABLE_INSTALL_TOOL`](../../Administration/DirectoryStructure/FlagFiles.md#file-config-enable-install-tool) file {#security-install-tool-access-enable-file}

The [`ENABLE_INSTALL_TOOL`](../../Administration/DirectoryStructure/FlagFiles.md#file-config-enable-install-tool) flag file can be created by placing an empty
file in one of the following file paths:

**Composer-based installation**

-   [`var/transient/ENABLE_INSTALL_TOOL`](../../Administration/DirectoryStructure/FlagFiles.md#file-config-enable-install-tool)
-   [`config/ENABLE_INSTALL_TOOL`](../../Administration/DirectoryStructure/FlagFiles.md#file-config-enable-install-tool)

**Classic mode installation (No Composer)**

-   [`typo3temp/var/transient/ENABLE_INSTALL_TOOL`](../../Administration/DirectoryStructure/FlagFiles.md#file-config-enable-install-tool)
-   [`typo3conf/ENABLE_INSTALL_TOOL`](../../Administration/DirectoryStructure/FlagFiles.md#file-config-enable-install-tool)

You usually need write access to this directory on the server level (for example,
via SSH, SFTP, etc.) or you can create this file as a backend user with
administrator privileges.

> [!TIP]
> Add the [`ENABLE_INSTALL_TOOL`](../../Administration/DirectoryStructure/FlagFiles.md#file-config-enable-install-tool) file to your project's `.gitignore`
> file to avoid accidentally committing and deploying it to production
> environments.

![](../../Images/ManualScreenshots/AdminTools/EnableInstallTool.png)

> [!WARNING]
> **Caution**
>
> This file should be removed or renamed after use to secure the
> Install Tool and prevent unauthorized access.
>
> TYPO3 automatically
> deletes the [`ENABLE_INSTALL_TOOL`](../../Administration/DirectoryStructure/FlagFiles.md#file-config-enable-install-tool) file when you log out of the Install
> Tool or if the file is older than 60 minutes (expiry time).
>
> The file can be prevented from being deleted if it contains "KEEP_FILE" as
> content. In this case it will not be deleted automatically! Only use this
> feature during local development, for example in
> [DDEV](https://docs.typo3.org/m/typo3/tutorial-getting-started/14.3/en-us/Installation/Install.html#installation-ddev-tutorial)!

### The Install Tool password {#security-install-tool-password}

<!-- TODO: no Markdown rendering for "versionadded" -->

You can also use command vendor/bin/typo3 install:password:set

The password for accessing the Install Tool is stored using the
[configured password hash mechanism](https://docs.typo3.org/permalink/t3coreapi:password-hashing@14.3) set for the backend
in the global configuration file `config/system/settings.php`:

**config/system/settings.php (excerpt)**

```php
<?php

return [
  'BE' => [
    'installToolPassword' => '$P$CnawBtpk.D22VwoB2RsN0jCocLuQFp.',
    // ...
  ],
];

```

The Install Tool password is initially set during the
installation process. This means that if a system administrator
hands over a TYPO3 instance to you, they should also provide you
with the password.

The first thing you should do, after taking over a new TYPO3 system from
a system administrator, is to change the password, making sure that the new
password is secure:

#### Change the install tool password by console command {#security-install-tool-password-change-command}

You can use the command [vendor/bin/typo3 install:password:set](https://docs.typo3.org/permalink/t3coreapi:console-command-install-password-set@14.3)
to change the install tool password:

**Composer-mode**

```bash
vendor/bin/typo3 install:password:set
```

**Classic mode**

```bash
typo3/sysext/core/bin/typo3 install:password:set
```

**DDEV**

```bash
ddev typo3 install:password:set
```

This only works if [$GLOBALS\['TYPO3_CONF_VARS'\]\['BE'\]\['installToolPassword'\]](https://docs.typo3.org/permalink/t3coreapi:confval-globals-typo3-conf-vars-be-installtoolpassword@14.3)
has not been overridden in file `config/system/additional.php`.

> [!WARNING]
> This password gives an attacker full control over your instance if cracked.
> It should be strong (include lower and upper case characters, special
> characters and numbers) and be at least eight characters long.

#### Change the install tool password via GUI {#security-install-tool-password-change-gui}

This can only be done if you know the current install tool password and can log
into the Install Tool:

Log-in to the Install Tool and change it in **System > Settings > Change
install tool password**.

![](../../Images/ManualScreenshots/AdminTools/ChangeInstallToolPassword.png)

### Accessing the Install Tool in the backend {#security-install-tool-backend-access}

The [System Maintainer](https://docs.typo3.org/permalink/t3coreapi:confval-globals-typo3-conf-vars-sys-systemmaintainers@14.3)
role allows for selected backend users to access the
**System** components from within the backend.

The behavior depends on the current [Application Context](https://docs.typo3.org/permalink/t3coreapi:application-context@14.3):

-   **Development context:**
    All backend users with administrator privileges can access the
    **System** modules directly without further security measures.
-   **Testing context:**
    All backend users with administrator privileges can see the
    **System** in the backend. However, an additional
    authentication step ("sudo mode") is required. The user must re-enter
    either their own backend password or the Install Tool password.
-   **Production context:**
    Only users listed as [System Maintainers](https://docs.typo3.org/permalink/t3coreapi:confval-globals-typo3-conf-vars-sys-systemmaintainers@14.3)
    can access the **System** modules. In addition, an extra authentication
    step ("sudo mode") is required. The user must re-enter either their own
    backend password or the Install Tool password before being granted access.

The number of system maintainers should be as low as possible to mitigate
the risks of corrupted accounts.

Users can be assigned the role in the **System > Settings** section of
**Install Tool** -> **Manage System Maintainers**.
It is also possible to manually modify the list by adding or removing the
user's UID (`be_users.uid`) in `config/system/settings.php`:

**config/system/settings.php (excerpt)**

```php
<?php

return [
  // ...
  'SYS' => [
    'systemMaintainers' => [1, 7, 36],
    // ...
  ],
];

```

If TYPO3 is not set up or does not work properly, the Install Tool can also
be reached via `https://example.org/?__typo3_install`. Use this address
for recovery only. The parameter might be removed in a future TYPO3 version.

For additional security, you can deny requests that have the `__typo3_install`
parameter at the web server level, or protect them by user authentication of
the web server. If the Install Tool is not needed on a live server, you can
remove [`typo3/cms-install`](https://packagist.org/packages/typo3/cms-install): in Classic mode this is the folder
`typo3/sysext/install`. Please keep in mind that this will have an
impact on the usability of the system. If you are not the only person who
will use the Install Tool, discuss the best approach with your team.

## TYPO3 Core updates {#security-install-tool-core-updates}

In Classic mode installations the Install Tool allows integrators to update the
TYPO3 Core with a click on a button. This feature can be found under
**Important actions**, and it checks/installs revision updates only
(that is, bug fixes and security updates).

![Install Tool function to update the TYPO3 Core](../../Images/ManualScreenshots/Security/CoreUpdates.png)

This feature can be disabled by an environment variable:

```none
TYPO3_DISABLE_CORE_UPDATER=1
```

## Encryption key {#security-encryption-key}

The `encryptionKey` can be found in the Install Tool (module
**Settings** \> **Configure Installation-Wide Options**).
This string, usually a hexadecimal hash value of 96 characters, is used
as the salt for various kinds of encryptions, checksums and validations
(for example for the [cHash](https://docs.typo3.org/permalink/t3coreapi:chash@14.3)). Therefore, a change
of this value invalidates temporary information, cache content, etc.
and you should clear all caches after you changed this value in order
to force the rebuild of this data with the new encryption key.

> [!WARNING]
> **Attention**
>
> Keep in mind that this string is security-related and you should keep
> it in a safe place.

### Generating the encryption key {#security-encryption-key-generate}

The encryption key should be a random 96 characters long hexadecimal string.
You can for example create it with OpenSSL:

```bash
openssl rand -hex 48
```

It is possible to generate the encryption key via an API within TYPO3:

```php
use \TYPO3\CMS\Core\Crypto\Random;
use \TYPO3\CMS\Core\Utility\GeneralUtility;

$encryptionKey = GeneralUtility::makeInstance(Random::class)->generateRandomHexString(96);
```