diff --git a/crates/dbx-web/src/auth.rs b/crates/dbx-web/src/auth.rs
index d54009f08..b01d5aa12 100644
--- a/crates/dbx-web/src/auth.rs
+++ b/crates/dbx-web/src/auth.rs
@@ -85,6 +85,10 @@ pub async fn login(State(state): State<Arc<WebState>>, Json(body): Json<LoginReq
 }
 
 pub async fn setup(State(state): State<Arc<WebState>>, Json(body): Json<LoginRequest>) -> Result<Response, StatusCode> {
+    if state.password_disabled {
+        return Err(StatusCode::FORBIDDEN);
+    }
+
     // Only allow setup when no password is configured
     if state.password_hash.read().await.is_some() {
         return Err(StatusCode::FORBIDDEN);
@@ -115,6 +119,9 @@ pub async fn setup(State(state): State<Arc<WebState>>, Json(body): Json<LoginReq
 }
 
 pub async fn check(State(state): State<Arc<WebState>>, req: Request<axum::body::Body>) -> Json<AuthCheckResponse> {
+    if state.password_disabled {
+        return Json(AuthCheckResponse { authenticated: true, required: false, setup_required: false });
+    }
     let has_password = state.password_hash.read().await.is_some();
     if !has_password {
         return Json(AuthCheckResponse { authenticated: false, required: false, setup_required: true });
diff --git a/crates/dbx-web/src/main.rs b/crates/dbx-web/src/main.rs
index 9fc2dbba9..d2beb0b52 100644
--- a/crates/dbx-web/src/main.rs
+++ b/crates/dbx-web/src/main.rs
@@ -62,7 +62,13 @@ async fn main() {
     };
 
     // Password hash: env var takes priority, then database
-    let password_hash = if let Ok(pw) = std::env::var("DBX_PASSWORD") {
+    let password_disabled = std::env::var("DBX_DISABLE_PASSWORD")
+        .map(|v| matches!(v.trim().to_lowercase().as_str(), "1" | "true" | "yes" | "on"))
+        .unwrap_or(false);
+
+    let password_hash = if password_disabled {
+        None
+    } else if let Ok(pw) = std::env::var("DBX_PASSWORD") {
         let salt = SaltString::generate(&mut OsRng);
         Some(Argon2::default().hash_password(pw.as_bytes(), &salt).expect("Failed to hash password").to_string())
     } else {
@@ -72,6 +78,7 @@ async fn main() {
     let web_state = Arc::new(WebState {
         app: app_state,
         data_dir,
+        password_disabled,
         password_hash: RwLock::new(password_hash),
         sessions: RwLock::new(HashSet::new()),
         sse_channels: RwLock::new(HashMap::new()),
@@ -358,7 +365,9 @@ async fn main() {
     let addr = SocketAddr::from(([0, 0, 0, 0], port));
 
     tracing::info!("DBX Web server starting on http://{}", addr);
-    if std::env::var("DBX_PASSWORD").is_ok() {
+    if password_disabled {
+        tracing::info!("Password protection is disabled");
+    } else if std::env::var("DBX_PASSWORD").is_ok() {
         tracing::info!("Password protection is enabled");
     }
 
diff --git a/crates/dbx-web/src/state.rs b/crates/dbx-web/src/state.rs
index 80c1f3951..3ae174f3d 100644
--- a/crates/dbx-web/src/state.rs
+++ b/crates/dbx-web/src/state.rs
@@ -13,6 +13,7 @@ pub struct LoginRateLimit {
 pub struct WebState {
     pub app: Arc<AppState>,
     pub data_dir: PathBuf,
+    pub password_disabled: bool,
     pub password_hash: RwLock<Option<String>>,
     pub sessions: RwLock<HashSet<String>>,
     pub sse_channels: RwLock<HashMap<String, broadcast::Sender<String>>>,