Home Assistant is getting a new integration called Debug console: a Python prompt inside the running Home Assistant, much like the console in a web browser's developer tools. Franck Nijhof's backend (#186547) and the frontend tab (#54937) were both merged on 16 October 2026, and the documentation lists the integration for Home Assistant 2026.11.

What it does

The console is under Settings > Tools > Debug console once it is enabled. You type Python, press Enter, and the code runs in Home Assistant's own process with the hass object available. That means you can read the state of any entity, call actions, or poke at an integration's internals while it runs, without adding log lines and restarting.

A few details from the documentation:

  • await works at the top level, so you can call asynchronous functions directly.
  • Results and print() output appear as an expandable object tree. Properties are shown as (...) and only run when you click them, because reading a property can have side effects.
  • Completion and signature hints never run your code.
  • Code that waits does not block the console, and a Stop button (or Ctrl+C) stops it.
  • Variables are kept per user and browser tab, and a session is dropped 30 minutes after its tab disconnects or when Home Assistant restarts.

There is one hard limit. The code runs in Home Assistant's event loop, so a blocking call such as time.sleep() freezes the whole server until it finishes, and Stop cannot interrupt it.

Locked down on purpose

The documentation is blunt about the risk. Code in the console has the same access as Home Assistant itself and can read and change everything, including configuration, passwords and tokens. There are no safety checks, and the warning tells users that people who ask them to paste code into the console may be trying to take over their system.

Several safeguards follow from that:

  • The integration can only be enabled with debug_console: in configuration.yaml and a restart, not from the user interface. The documentation explains why: code running in the browser, such as a custom card, should not be able to switch it on.
  • Only administrators can use it.
  • Each administrator has to accept a warning first, and can only confirm after reading it for a few seconds.
  • Pasting is blocked until you type allow pasting, as in browser consoles.
  • Everything that runs is written to the Home Assistant log, together with who ran it.

To turn it off, remove debug_console: and restart. Code you ran stays in the browser's history and in the log.

Who it is for

The documentation says outright that everyday users do not need it. It is aimed at integration developers and at people tracking down a bug with help from someone who knows the code. While building it, Nijhof also found the bug that let deleted users keep their open connections, fixed in Home Assistant 2026.10.2.