diff --git a/configs/photoprism.yml b/configs/photoprism.yml
index f7c0e56df..51c7343ed 100644
--- a/configs/photoprism.yml
+++ b/configs/photoprism.yml
@@ -7,8 +7,10 @@ import-path: /srv/photoprism/photos/import
 export-path: /srv/photoprism/photos/export
 sql-host: localhost
 sql-port: 4000
+sql-password:
 http-host:
 http-mode: release
 http-port: 80
+http-password:
 database-driver: internal
 database-dsn: root:@tcp(localhost:4000)/photoprism?parseTime=true
\ No newline at end of file
diff --git a/internal/commands/flags.go b/internal/commands/flags.go
index 17cb5a99c..620d4899d 100644
--- a/internal/commands/flags.go
+++ b/internal/commands/flags.go
@@ -81,22 +81,34 @@ var GlobalFlags = []cli.Flag{
 		Value:  "",
 		EnvVar: "PHOTOPRISM_HTTP_MODE",
 	},
+	cli.StringFlag{
+		Name:   "http-password",
+		Usage:  "HTTP server password (optional)",
+		Value:  "",
+		EnvVar: "PHOTOPRISM_HTTP_PASSWORD",
+	},
 	cli.IntFlag{
 		Name:   "sql-port, s",
-		Usage:  "Built-in SQL server port",
+		Usage:  "built-in SQL server port",
 		Value:  4000,
 		EnvVar: "PHOTOPRISM_SQL_PORT",
 	},
 	cli.StringFlag{
 		Name:   "sql-host",
-		Usage:  "Built-in SQL server host",
+		Usage:  "built-in SQL server host",
 		Value:  "",
 		EnvVar: "PHOTOPRISM_SQL_HOST",
 	},
 	cli.StringFlag{
 		Name:   "sql-path",
-		Usage:  "Built-in SQL server storage path",
+		Usage:  "built-in SQL server storage path",
 		Value:  "",
 		EnvVar: "PHOTOPRISM_SQL_PATH",
 	},
+	cli.StringFlag{
+		Name:   "sql-password",
+		Usage:  "built-in SQL server password",
+		Value:  "",
+		EnvVar: "PHOTOPRISM_SQL_PASSWORD",
+	},
 }
diff --git a/internal/context/config.go b/internal/context/config.go
index b2ef44528..0bb543d8c 100644
--- a/internal/context/config.go
+++ b/internal/context/config.go
@@ -30,26 +30,28 @@ const (
 //
 // See https://github.com/photoprism/photoprism/issues/50#issuecomment-433856358
 type Config struct {
-	appName        string
-	appVersion     string
-	appCopyright   string
-	debug          bool
-	configFile     string
-	assetsPath     string
-	cachePath      string
-	originalsPath  string
-	importPath     string
-	exportPath     string
-	sqlServerHost  string
-	sqlServerPort  uint
-	sqlServerPath  string
-	httpServerHost string
-	httpServerPort int
-	httpServerMode string
-	darktableCli   string
-	databaseDriver string
-	databaseDsn    string
-	db             *gorm.DB
+	appName            string
+	appVersion         string
+	appCopyright       string
+	debug              bool
+	configFile         string
+	assetsPath         string
+	cachePath          string
+	originalsPath      string
+	importPath         string
+	exportPath         string
+	sqlServerHost      string
+	sqlServerPort      uint
+	sqlServerPath      string
+	sqlServerPassword  string
+	httpServerHost     string
+	httpServerPort     int
+	httpServerMode     string
+	httpServerPassword string
+	darktableCli       string
+	databaseDriver     string
+	databaseDsn        string
+	db                 *gorm.DB
 }
 
 // NewConfig() creates a new configuration entity by using two methods:
@@ -90,6 +92,10 @@ func (c *Config) SetValuesFromFile(fileName string) error {
 		c.sqlServerPort = uint(sqlServerPort)
 	}
 
+	if sqlServerPassword, err := yamlConfig.Get("sql-password"); err == nil {
+		c.sqlServerPassword = sqlServerPassword
+	}
+
 	if sqlServerPath, err := yamlConfig.Get("sql-path"); err == nil {
 		c.sqlServerPath = sqlServerPath
 	}
@@ -102,8 +108,12 @@ func (c *Config) SetValuesFromFile(fileName string) error {
 		c.httpServerPort = int(httpServerPort)
 	}
 
-	if serverMode, err := yamlConfig.Get("http-mode"); err == nil {
-		c.httpServerMode = serverMode
+	if httpServerMode, err := yamlConfig.Get("http-mode"); err == nil {
+		c.httpServerMode = httpServerMode
+	}
+
+	if httpServerPassword, err := yamlConfig.Get("http-password"); err == nil {
+		c.httpServerPassword = httpServerPassword
 	}
 
 	if assetsPath, err := yamlConfig.Get("assets-path"); err == nil {
@@ -340,6 +350,11 @@ func (c *Config) SqlServerPath() string {
 	return c.ServerPath() + "/database"
 }
 
+// SqlServerPassword returns the password for the built-in database server.
+func (c *Config) SqlServerPassword() string {
+	return c.sqlServerPassword
+}
+
 // HttpServerHost returns the built-in HTTP server host name or IP address (empty for all interfaces).
 func (c *Config) HttpServerHost() string {
 	return c.httpServerHost
@@ -355,6 +370,11 @@ func (c *Config) HttpServerMode() string {
 	return c.httpServerMode
 }
 
+// HttpServerPassword returns the password for the user interface (optional).
+func (c *Config) HttpServerPassword() string {
+	return c.httpServerPassword
+}
+
 // OriginalsPath returns the originals.
 func (c *Config) OriginalsPath() string {
 	return c.originalsPath
diff --git a/internal/photoprism/config.go b/internal/photoprism/config.go
index d0ef0b0b2..2518f01b4 100644
--- a/internal/photoprism/config.go
+++ b/internal/photoprism/config.go
@@ -25,10 +25,12 @@ type Config interface {
 	SqlServerHost() string
 	SqlServerPort() uint
 	SqlServerPath() string
+	SqlServerPassword() string
 
 	HttpServerHost() string
 	HttpServerPort() int
 	HttpServerMode() string
+	HttpServerPassword() string
 	HttpTemplatesPath() string
 	HttpFaviconsPath() string
 	HttpPublicPath() string
diff --git a/internal/test/config.go b/internal/test/config.go
index 7cc9b7114..bf7d2be72 100644
--- a/internal/test/config.go
+++ b/internal/test/config.go
@@ -198,11 +198,21 @@ func (c *Config) SqlServerPort() uint {
 	return 4001
 }
 
+// SqlServerPassword returns the password for the built-in database server.
+func (c *Config) SqlServerPassword() string {
+	return "photoprism"
+}
+
 // HttpServerMode returns the server mode.
 func (c *Config) HttpServerMode() string {
 	return "test"
 }
 
+// HttpServerPassword returns the password for the Web UI.
+func (c *Config) HttpServerPassword() string {
+	return ""
+}
+
 // OriginalsPath returns the originals.
 func (c *Config) OriginalsPath() string {
 	return OriginalsPath