How to Reset Your Joomla Administrator Password

If you have forgotten your Joomla administrator password, you can set a new one through another user account, the database or the server console. The right method depends on your Joomla version and the access you still have. This guide covers the main releases from Joomla 1.0 to Joomla 6, with compatibility notes at the start of each method.

Before you start

Joomla stores a password hash, not the original password. Recovery means setting a new password; you cannot read the old one from the database.

Check your keyboard layout, Caps Lock and username first. An incorrect username can look like a password problem. Identify the exact Joomla version before choosing a method, especially on older websites.

Choose the access you still have:

• Another super administrator can change your password in the administration panel.
• With SSH access, Joomla 4–6 provides a built-in password reset command.
• With database access, you can replace the password hash using the method appropriate to your version.
• From Joomla 1.6 onwards, configuration.php can temporarily grant super user privileges to a known account.
• Email recovery is available for eligible accounts, with restrictions for super users.

Use another super administrator account

Ask another super administrator to sign in to the administration panel and change the password.

1. Open the user manager. In older versions it is called User Manager; newer versions provide a Users section.
2. Find the account by its username and email address. Do not rely only on its display name.
3. Open the user, enter a new password and confirm it if the form requires confirmation.
4. Save the changes.
5. Test the new password in a private browser window.

In Joomla 1.0 and 1.5, the highest built-in group is Super Administrator. From Joomla 1.6 onwards, the standard group is Super Users. Actual permissions still matter: a custom group name does not guarantee permission to edit a super user.

Use SSH or your hosting terminal

Open an SSH session or your hosting control panel's terminal. Go to the root directory of the correct Joomla installation, where configuration.php and the cli directory are located.

Run:

php cli/joomla.php user:reset-password

Follow the prompts to choose the user and set a new password. You can specify the username when starting the command:

php cli/joomla.php user:reset-password --username="your-login"

Replace your-login with the actual username. Enter the password at the interactive prompt so that it does not become part of the command or shell history. Password input may be hidden; this is normal.

To check the options available in your installed version, run:

php cli/joomla.php user:reset-password --help

After the command completes, test the administrator login. If the console fails before reaching the password prompt, check the PHP version used by the terminal. It may differ from the PHP version serving the website. Use a PHP executable supported by your installed Joomla release.

Reset the password through the database

Find the database and user

Open configuration.php in the Joomla root directory. Joomla 1.0 uses $mosConfig_db and $mosConfig_dbprefix for the database name and table prefix. Later versions use $db and $dbprefix.

Open the correct database in phpMyAdmin or another database management tool. Find the users table: replace the placeholder prefix in prefix_users with your site's actual prefix.

Locate the account by username and email, and note its id. Do not assume that the super administrator has a particular ID or that the username is admin. Back up the record before editing it.

Joomla 1.0–2.5 and Joomla 3.0–3.1

In phpMyAdmin:

1. Open the required user record for editing.
2. Locate the password field.
3. Choose MD5 in the Function column for that field.
4. Enter a unique temporary password in the Value field.
5. Save the record and try signing in.
6. After signing in, immediately set a new password through Joomla's user profile or user manager.

When MD5 is selected, enter the plain temporary password, not an existing hash. Otherwise it will be hashed twice. Do not use MySQL's PASSWORD() function: its result is not the required Joomla password format.

Joomla 3.2.1–3.10 and Joomla 4–6

Generate a bcrypt hash in a trusted PHP environment using your chosen new password. The relevant PHP expression is:

$hash = password_hash($newPassword, PASSWORD_BCRYPT);

Here, $newPassword contains your new password and $hash receives the resulting hash. This is an example expression, not a complete recovery file to upload to the website. Do not send your password to an online hash generator or leave a public PHP file containing it on the server.

1. Copy the complete generated hash, normally beginning with $2y$.
2. Open the correct user record in the users table.
3. Replace the password field with the complete hash.
4. Leave the Function selector empty. Do not apply MD5 or another database function.
5. Save the record and test the login.

Check that the hash was copied without spaces, line breaks or missing characters. Once access is restored, you can set the final password through Joomla itself.

Special considerations for Joomla 3.2.0

Prefer another super administrator account or the temporary root_user method described below. Do not try random hash formats or disable Strong Passwords without understanding the site's configuration.

If neither method is available, back up the site and assess its exact PHP version and authentication configuration before changing the database. Recovery on this transitional release may require individual investigation.

What replacing the password does not fix

Changing the password field does not unblock an account, grant administrator permissions or remove two-factor or multi-factor authentication. Do not change unrelated fields or user group assignments just because the new password does not allow access.

Use configuration.php

This method temporarily grants super user privileges to an existing account whose username and password you know. Prefer an existing manager or administrator account that can access the administration panel.

1. Make a backup of configuration.php and store it outside the public web directory.
2. Open the original configuration.php in the Joomla root directory.
3. Inside the JConfig class, before its closing brace, add:

public $root_user = 'known-login';

4. Replace known-login with the exact username of the existing account. Do not add a second root_user declaration if one already exists.
5. Save the file and sign in with that account's existing password.
6. Open the user manager and reset the affected super administrator's password.
7. Remove the temporary root_user line from configuration.php.
8. Restore the file's original permissions if you changed them for editing.
9. Test the recovered account and confirm that the temporary account no longer has the extra privileges.

Recover access by email

Joomla 1.6–6

For an eligible account, open the site's Forgotten Password link or the following path relative to the site root:

index.php?option=com_users&view=reset

Then:

1. Enter the email address associated with your account.
2. Open the email sent by the website.
3. Follow the link and instructions. The form may request your username and a verification code.
4. Set a new password and test the login.

Access to the administration panel does not by itself prevent an email reset. The restriction concerns global super user permissions, not the word administrator in a job title or group name.

For a Super User account, use another method in this guide.

Joomla 1.0 and 1.5

These versions use older recovery forms. Start with the Forgot your password? link in the login module.

For Joomla 1.5, the form's path relative to the site root is:

index.php?option=com_user&view=reset

Notice the singular com_user. The com_users route used by newer versions does not apply.

Follow the instructions shown by your installed version. Do not assume that the old form guarantees super administrator recovery: its behaviour depends on the exact release and installed extensions. If the form refuses the request or no email arrives, use database recovery.

If the email does not arrive

Check the spam folder and confirm the address. Mail server settings, a blocked account or reset request limits may also be involved.

Repeatedly submitting the form will not fix a delivery problem. If you no longer have access to the mailbox, choose another recovery method.

If the new password still does not work

Identify the stage at which access fails. Another restriction may be responsible.

An additional code is requested. Built-in two-factor authentication arrived in Joomla 3.2, and multi-factor authentication in Joomla 4.2. Changing the password does not bypass this check. Use your configured authentication method or a saved emergency code. Extensions may also provide additional authentication on older sites.

The account is blocked. Investigate why it was blocked and restore access through an authorised administrator.

The login form does not open. Check the correct administrator URL and any security extension that restricts access to it. Changing a password in the database does not resolve an inaccessible login page.

The site uses an external identity provider. If authentication is handled by LDAP, SSO or another external service, the password may need to be changed there. The local database password is not necessarily used for that login.

The password appears unchanged. Confirm that you edited the database and user belonging to this exact installation, rather than a backup or staging copy.

Do not disable every plugin as a general recovery step. First establish which component is preventing access.

After restoring access

Set a strong, unique password and store it in a password manager. Check the account's email address. Enable additional authentication where supported and keep emergency codes in a safe place.

Remove temporary root_user settings and any files created during recovery. Check that configuration.php has appropriate permissions and that backups containing credentials are not publicly accessible.

If the password changed unexpectedly or you find unfamiliar administrator accounts, investigate possible unauthorised access. A password reset alone does not remove malicious files or close a compromised entry point.

For an old website, prepare a backup and an upgrade or migration plan after recovery. Do not start a major upgrade without checking extension compatibility.

Conclusion

All the Joomla versions covered here support recovery through another super administrator or the database. When editing the database, use the correct password hash format: legacy and modern releases require different instructions.

Temporary root_user access is available from Joomla 1.6, and the built-in password reset command from Joomla 4. Choose a method that matches your version and remaining access, then test the login and remove temporary recovery measures.