diff --git a/README.md b/README.md
index 41c1bc21..a4ee0554 100644
--- a/README.md
+++ b/README.md
@@ -20,6 +20,7 @@
 - Set timed wake and shutdown events via cron
 - Add custom ports to devices which will be pinged
 - Discover devices by scanning network
+- User/Password protected login
 - Dark/light or system prefered color scheme
 - [Docker images](https://github.com/seriousm4x/UpSnap/pkgs/container/upsnap) for amd64, arm64, arm/v7
 
@@ -27,6 +28,7 @@
 
 | Dark                           | Light                           |
 | ------------------------------ | ------------------------------- |
+| ![](/assets/login_dark.png)    | ![](/assets/login_light.png)    |
 | ![](/assets/home_dark.png)     | ![](/assets/home_light.png)     |
 | ![](/assets/device_dark.png)   | ![](/assets/device_light.png)   |
 | ![](/assets/settings_dark.png) | ![](/assets/settings_light.png) |
@@ -70,6 +72,36 @@ upsnap.example.com {
 }
 ```
 
+## 🔒 Authentification
+
+**Since version 3.1 authentification is enabled by default.**
+
+User management is done through the PocketBase webinterface at [http://localhost:8090/\_/](http://localhost:8090/_/). This is mainly for internal use, such as within a home or corporate network. For external use please see below.
+
+- To manage users, click the "Collections" icon on the left and select "users".
+- To manage admins, click the "Settings" icon on the left and select "Admin".
+
+Api permissions listed by user role:
+
+| Api              | Unauthorized | Users | Admins |
+| ---------------- | ------------ | ----- | ------ |
+| List/Search Rule | ❌           | ✅    | ✅     |
+| View Rule        | ❌           | ✅    | ✅     |
+| Create Rule      | ❌           | ❌    | ✅     |
+| Delete Rule      | ❌           | ❌    | ✅     |
+| Manage Rule      | ❌           | ❌    | ✅     |
+| Wake devices     | ❌           | ✅    | ✅     |
+| Shutdown devices | ❌           | ✅    | ✅     |
+| Scan network     | ❌           | ❌    | ✅     |
+
+## 🌍 Exposing to the open web
+
+Although UpSnap has user authentification, it is **not recommended to expose it to the open web** and make it accessible by everyone!
+
+**Reason**: The shutdown device command is basically a command piped to #sh (root if you run docker). If anyone gains unauthorized access and can abuse this api route in any way, the attacker has access to a (root) shell on your local network.
+
+**Recommended**: If you need access from outside your network, please use a vpn. Wireguard or OpenVPN is your way to go.
+
 ## 🔧 Help developing
 
 Fork this branch and clone it.
diff --git a/assets/login_dark.png b/assets/login_dark.png
new file mode 100644
index 00000000..92c16e75
Binary files /dev/null and b/assets/login_dark.png differ
diff --git a/assets/login_light.png b/assets/login_light.png
new file mode 100644
index 00000000..958d8c72
Binary files /dev/null and b/assets/login_light.png differ
diff --git a/docker-compose.yml b/docker-compose.yml
index e5c3efcd..bb124514 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -12,6 +12,7 @@ services:
     #   - UPSNAP_INTERVAL=@every 10s # Sets the interval in which the devices are pinged
     #   - UPSNAP_SCAN_RANGE=192.168.1.0/24 # Scan range is used for device discovery on local network
     #   - UPSNAP_WEBSITE_TITLE=Custom name # Custom website title
+    #   - UPSNAP_WELCOME_MESSAGE="Welcome to my wake on lan dashboard" # Show this message on the login form
     # you can change the listen ip:port inside the container like this:
     # entrypoint: /bin/sh -c "./upsnap serve --http 0.0.0.0:5000"
     # healthcheck:
diff --git a/frontend/src/stores/pocketbase.ts b/frontend/src/stores/pocketbase.ts
index 99a66afa..9bbbc4cc 100644
--- a/frontend/src/stores/pocketbase.ts
+++ b/frontend/src/stores/pocketbase.ts
@@ -2,11 +2,7 @@ import { writable } from 'svelte/store';
 import PocketBase from 'pocketbase';
 
 // set backend url based on environment
-let backend_url = '/';
-let isDevMode = import.meta.env.DEV;
-if (isDevMode) {
-    backend_url = 'http://127.0.0.1:8090';
-}
+let backend_url = import.meta.env.DEV ? 'http://127.0.0.1:8090' : '/';
 
 // get default values for stores
 const pb = new PocketBase(backend_url);