diff --git a/src/ajax.php b/src/ajax.php
index b15bb3c..acc445f 100644
--- a/src/ajax.php
+++ b/src/ajax.php
@@ -306,8 +306,7 @@ elseif(isset($_POST['login']))
 		$t['disabled'] = 1;
 		jsonExit($t);
 	}
-	$password = _post('password');
-	if($password == Config::get('password')) {
+	if ( isPasswordEqualsToHash(_post('password'), Config::get('password')) ) {
 		$t['logged'] = 1;
 		session_regenerate_id(1);
 		$_SESSION['logged'] = 1;
diff --git a/src/includes/class.config.php b/src/includes/class.config.php
index d12604e..57bbf8d 100644
--- a/src/includes/class.config.php
+++ b/src/includes/class.config.php
@@ -105,6 +105,9 @@ class Config
 				$key = 'db.driver';
 				$val = 'mysqli';
 			}
+			elseif ($key == 'password' && $val != '') {
+				$val = passwordHash($val); // in v1.7 password is hashed
+			}
 			// if (!isset(self::$dbparams[$key])) {
 			// 	throw new Exception("Unknown key: $key");
 			// }
diff --git a/src/includes/common.php b/src/includes/common.php
index 292aac3..fab3b26 100644
--- a/src/includes/common.php
+++ b/src/includes/common.php
@@ -122,4 +122,28 @@ function generateUUID(): string
     );
 }
 
+function passwordHash(string $p): string
+{
+	if ($p == '') return '';
+	return 'sha256:'. hash('sha256', $p);
+}
+
+/**
+ * Compares raw (not hashed) password with password hash. Return true if equals.
+ * @param string $p Raw password
+ * @param string $hash Password hash
+ * @return bool
+ */
+function isPasswordEqualsToHash(string $p, string $hash): bool
+{
+	if ($hash == '' && $p == '') return true;
+	if ($hash == '' || $p == '') return false;
+	if ( false !== $pos = strpos($hash, ':') ) {
+		$algo = substr($hash, 0, $pos);
+		if ($algo != 'sha256') throw new Exception("Unsupported algo of password hash");
+		if ( hash_equals($hash, passwordHash($p)) ) return true;
+	}
+	return false;
+}
+
 ?>
\ No newline at end of file
diff --git a/src/init.php b/src/init.php
index a92fb8d..0116190 100644
--- a/src/init.php
+++ b/src/init.php
@@ -108,25 +108,25 @@ function requireConfig()
 	}
 }
 
-function need_auth()
+function need_auth(): bool
 {
-	return (Config::get('password') != '') ? 1 : 0;
+	return (Config::get('password') != '') ? true : false;
 }
 
-function is_logged()
+function is_logged(): bool
 {
 	if ( !need_auth() ) return true;
 	if ( isset($_SESSION['logged']) && $_SESSION['logged'] ) return true;
 	return false;
 }
 
-function is_readonly()
+function is_readonly(): bool
 {
 	if ( !is_logged() ) return true;
 	return false;
 }
 
-function access_token()
+function access_token(): string
 {
 	if (!need_auth()) return '';
 	if (!isset($_SESSION)) return '';
diff --git a/src/settings.php b/src/settings.php
index 28e355c..2c9a9e9 100644
--- a/src/settings.php
+++ b/src/settings.php
@@ -30,8 +30,9 @@ if(isset($_POST['save']))
 		jsonExit($t);
 	}
 
-	if(isset($_POST['password']) && $_POST['password'] != '') Config::set('password', $_POST['password']);
-	elseif(!_post('allowpassword')) Config::set('password', '');
+	if (isset($_POST['password']) && $_POST['password'] != '') Config::set('password', passwordHash($_POST['password'])) ;
+	elseif (!_post('allowpassword')) Config::set('password', '');
+
 	Config::set('smartsyntax', (int)_post('smartsyntax'));
 	// Do not set invalid timezone
 	try {