diff --git a/modules/pihole/assets/pihole_instances.js b/modules/pihole/assets/pihole_instances.js
index 0f07989..7cd9e9a 100644
--- a/modules/pihole/assets/pihole_instances.js
+++ b/modules/pihole/assets/pihole_instances.js
@@ -12,7 +12,7 @@
   const idInput = form.querySelector('input[name="instance_id"]');
   const nameInput = form.querySelector('input[name="name"]');
   const urlInput = form.querySelector('input[name="url"]');
-  const tokenInput = form.querySelector('input[name="token"]');
+  const passwordInput = form.querySelector('input[name="password"]');
   const primaryInput = form.querySelector('input[name="is_primary"]');
 
   const resetForm = () => {
@@ -20,7 +20,7 @@
     if (idInput) idInput.value = '';
     if (nameInput) nameInput.value = '';
     if (urlInput) urlInput.value = '';
-    if (tokenInput) tokenInput.value = '';
+    if (passwordInput) passwordInput.value = '';
     if (primaryInput) primaryInput.checked = false;
   };
 
@@ -42,7 +42,7 @@
       if (idInput) idInput.value = card.dataset.instanceId || '';
       if (nameInput) nameInput.value = card.dataset.name || '';
       if (urlInput) urlInput.value = card.dataset.url || '';
-      if (tokenInput) tokenInput.value = '';
+      if (passwordInput) passwordInput.value = '';
       if (primaryInput) primaryInput.checked = card.dataset.primary === '1';
       if (title) title.textContent = 'Instanz bearbeiten';
       openModal();
diff --git a/modules/pihole/bootstrap.php b/modules/pihole/bootstrap.php
index 4351194..a30feee 100644
--- a/modules/pihole/bootstrap.php
+++ b/modules/pihole/bootstrap.php
@@ -25,6 +25,15 @@ $mm->registerFunction($moduleName, 'instances', function () use ($moduleName): a
 
     $verifyTls = !isset($settings['verify_tls']) || $settings['verify_tls'] === '1' || $settings['verify_tls'] === 1 || $settings['verify_tls'] === true;
 
+    $normalizeSecret = static function (array $row): string {
+        $password = trim((string)($row['password'] ?? ''));
+        if ($password !== '') {
+            return $password;
+        }
+
+        return trim((string)($row['token'] ?? ''));
+    };
+
     $instances = [];
 
     $rawJson = trim((string)($settings['instances_json'] ?? ''));
@@ -44,7 +53,7 @@ $mm->registerFunction($moduleName, 'instances', function () use ($moduleName): a
                     'id' => $id,
                     'name' => trim((string)($row['name'] ?? '')) ?: $id,
                     'url' => rtrim($url, '/'),
-                    'token' => trim((string)($row['token'] ?? '')),
+                    'password' => $normalizeSecret($row),
                     'api_path' => $apiPath,
                     'timeout' => $timeout,
                     'verify_tls' => $verifyTls,
@@ -67,7 +76,7 @@ $mm->registerFunction($moduleName, 'instances', function () use ($moduleName): a
                 'id' => $key,
                 'name' => trim((string)($settings[$nameKey] ?? '')) ?: ($key === 'primary' ? 'Primaer' : 'Sekundaer'),
                 'url' => rtrim($url, '/'),
-                'token' => trim((string)($settings[$tokenKey] ?? '')),
+                'password' => trim((string)($settings[$tokenKey] ?? '')),
                 'api_path' => $apiPath,
                 'timeout' => $timeout,
                 'verify_tls' => $verifyTls,
diff --git a/modules/pihole/design.json b/modules/pihole/design.json
index d9e8d7d..ef5b517 100644
--- a/modules/pihole/design.json
+++ b/modules/pihole/design.json
@@ -1,7 +1,7 @@
 {
   "eyebrow": "Modul",
   "title": "Pi-hole",
-  "description": "Pi-hole Monitoring, Listen und Steuerung fuer zwei Instanzen.",
+  "description": "Pi-hole Monitoring, Listen und Steuerung fuer mehrere Instanzen.",
   "actions": [
     { "label": "Zur Startseite", "href": "/", "variant": "ghost" },
     { "label": "Instanzen", "href": "/module/pihole/instances", "variant": "secondary" }
diff --git a/modules/pihole/module.json b/modules/pihole/module.json
index 380ad5d..2b9e437 100644
--- a/modules/pihole/module.json
+++ b/modules/pihole/module.json
@@ -1,6 +1,6 @@
 {
   "title": "Pi-hole",
   "version": "0.1.0",
-  "description": "Pi-hole Monitoring, Listen und Steuerung fuer zwei Instanzen.",
+  "description": "Pi-hole Monitoring, Listen und Steuerung fuer mehrere Instanzen.",
   "setup": { "fields": [] }
 }
diff --git a/modules/pihole/pages/api.php b/modules/pihole/pages/api.php
index 900a74c..4aa710f 100644
--- a/modules/pihole/pages/api.php
+++ b/modules/pihole/pages/api.php
@@ -91,8 +91,8 @@ $httpRequest = function (string $method, string $url, array $headers, ?string $b
 };
 
 $v5Request = function (array $instance, array $params) use ($normalizeApiPath, $httpRequest): array {
-    if (!empty($instance['token']) && !isset($params['auth'])) {
-        $params['auth'] = $instance['token'];
+    if (!empty($instance['password']) && !isset($params['auth'])) {
+        $params['auth'] = $instance['password'];
     }
 
     $url = $normalizeApiPath((string)$instance['url'], (string)$instance['api_path']);
@@ -116,7 +116,7 @@ $v6Auth = function (array $instance) use ($httpRequest): array {
         $timeout = 8;
     }
     $verify = !empty($instance['verify_tls']);
-    $payload = ['password' => (string)($instance['token'] ?? '')];
+    $payload = ['password' => (string)($instance['password'] ?? '')];
     $body = json_encode($payload, JSON_UNESCAPED_UNICODE);
     $res = $httpRequest('POST', $url, ['Accept: application/json', 'Content-Type: application/json'], $body, $verify, $timeout);
     if (!$res['ok']) {
@@ -159,7 +159,7 @@ $v6Request = function (array $instance, string $path, string $method, array $pay
 $detectApi = function (array $instance) use ($v6Auth, $v6Request, $v5Request): array {
     $sid = '';
     $authRes = null;
-    if (!empty($instance['token'])) {
+    if (!empty($instance['password'])) {
         $authRes = $v6Auth($instance);
         if (($authRes['ok'] ?? false) && !empty($authRes['sid'])) {
             $sid = (string)$authRes['sid'];
@@ -621,7 +621,7 @@ if ($action === 'test') {
             $message = 'Host nicht erreichbar oder kein HTTP-Response.';
         } elseif ($httpCode === 401 || $httpCode === 403) {
             $status = 'auth';
-            $message = 'API Passwort falsch oder nicht berechtigt.';
+            $message = 'Passwort oder App-Passwort falsch oder nicht berechtigt.';
         } elseif ($error === 'invalid_json') {
             $status = 'invalid';
             $message = 'API antwortet nicht mit JSON. URL pruefen.';
@@ -659,7 +659,7 @@ if ($action === 'test') {
         $message = 'Host nicht erreichbar oder kein HTTP-Response.';
     } elseif ($httpCode === 401 || $httpCode === 403) {
         $status = 'auth';
-        $message = 'API Token/Passwort falsch oder nicht berechtigt.';
+        $message = 'Passwort oder Legacy-API-Token falsch oder nicht berechtigt.';
     } elseif ($error === 'invalid_json') {
         $status = 'invalid';
         $message = 'API antwortet nicht mit JSON. URL oder API-Pfad pruefen.';
diff --git a/modules/pihole/pages/instances.php b/modules/pihole/pages/instances.php
index 0643704..f617068 100644
--- a/modules/pihole/pages/instances.php
+++ b/modules/pihole/pages/instances.php
@@ -11,6 +11,15 @@ $notice = null;
 $error = null;
 
 $loadInstances = function (array $settings): array {
+    $normalizeSecret = static function (array $row): string {
+        $password = trim((string)($row['password'] ?? ''));
+        if ($password !== '') {
+            return $password;
+        }
+
+        return trim((string)($row['token'] ?? ''));
+    };
+
     $instances = [];
     $rawJson = trim((string)($settings['instances_json'] ?? ''));
     if ($rawJson !== '') {
@@ -29,7 +38,7 @@ $loadInstances = function (array $settings): array {
                     'id' => $id,
                     'name' => trim((string)($row['name'] ?? '')) ?: $id,
                     'url' => $url,
-                    'token' => trim((string)($row['token'] ?? '')),
+                    'password' => $normalizeSecret($row),
                     'is_primary' => !empty($row['is_primary']),
                 ];
             }
@@ -46,7 +55,7 @@ $loadInstances = function (array $settings): array {
                 'id' => $key,
                 'name' => trim((string)($settings[$key . '_name'] ?? '')) ?: ($key === 'primary' ? 'Primaer' : 'Sekundaer'),
                 'url' => $url,
-                'token' => trim((string)($settings[$key . '_token'] ?? '')),
+                'password' => trim((string)($settings[$key . '_token'] ?? '')),
                 'is_primary' => $key === 'primary',
             ];
         }
@@ -74,7 +83,7 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST') {
     $instanceId = trim((string)($_POST['instance_id'] ?? ''));
     $name = trim((string)($_POST['name'] ?? ''));
     $url = trim((string)($_POST['url'] ?? ''));
-    $token = trim((string)($_POST['token'] ?? ''));
+    $password = trim((string)($_POST['password'] ?? ''));
     $isPrimary = isset($_POST['is_primary']);
 
     if ($deleteId !== '') {
@@ -87,11 +96,11 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST') {
         if ($instanceId === '' || $url === '') {
             $error = 'Bitte ID und URL angeben.';
         } else {
-            $existingToken = '';
+            $existingPassword = '';
             if ($currentId !== '' && isset($instances[$currentId])) {
-                $existingToken = (string)($instances[$currentId]['token'] ?? '');
+                $existingPassword = (string)($instances[$currentId]['password'] ?? '');
             }
-            $tokenToStore = $token !== '' ? $token : $existingToken;
+            $passwordToStore = $password !== '' ? $password : $existingPassword;
             if ($currentId !== '' && $currentId !== $instanceId) {
                 unset($instances[$currentId]);
             }
@@ -99,7 +108,7 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST') {
                 'id' => $instanceId,
                 'name' => $name !== '' ? $name : $instanceId,
                 'url' => $url,
-                'token' => $tokenToStore,
+                'password' => $passwordToStore,
                 'is_primary' => $isPrimary,
             ];
 
@@ -215,8 +224,8 @@ if ($primaryId === '') {
         <input type="text" name="url" placeholder="http://pi-hole.local" required>
       </label>
       <label class="form-field">
-        <span class="muted">API Token / Web-Passwort (v6) (leer lassen = unveraendert)</span>
-        <input type="password" name="token" placeholder="Token" autocomplete="new-password">
+        <span class="muted">Passwort / App-Passwort (leer lassen = unveraendert)</span>
+        <input type="password" name="password" placeholder="Pi-hole Passwort oder App-Passwort" autocomplete="new-password">
       </label>
       <label class="form-field" style="align-items:center;">
         <span class="muted">Als Primaer verwenden</span>