How to Reset a Joomla Super Admin Password (When You're Locked Out)

Locked out of your Joomla administrator and can't get back in? Don't panic, and don't go looking for the old "paste an MD5 into the database" trick. Since Joomla 3.2, passwords are hashed with bcrypt, not MD5, so those old tutorials simply won't work on any modern site (Joomla 4, 5, or 6).

Here are the reliable ways to reset a Super User password on a current Joomla site, easiest first. Use the first one that fits your access.

Method 1: The "Forgot your password?" link (easiest)

If your site can send email and you can reach the account's inbox, this is the fastest route and needs no technical access at all.

1. Go to your site's login page (or /administrator and use the front-end login).
2. Click Forgot your password?
3. Enter the account's email address. Joomla emails a reset link.
4. Follow the link, set a new password, and log in.

If no email arrives, your site's mail settings are probably broken (or you can't access that inbox) - use one of the methods below instead.

Method 2: The Joomla CLI (if you have SSH access)

Joomla 4, 5 and 6 ship a command-line console that can reset a password directly, no database editing required. From your Joomla site's root folder, run:

php cli/joomla.php user:reset-password

The console prompts you for the username, then the new password, and updates it correctly (properly bcrypt-hashed). This is the cleanest method when you have shell/SSH access.

Method 3: The database, the modern (bcrypt) way

When email and CLI aren't options, reset the password directly in the database with phpMyAdmin (or Adminer). The key difference from the old tutorials: you must store a real bcrypt hash, not an MD5 string.

Step 1: Back up the database first

You are about to edit a live table - take a database backup before you touch anything. (See how to back up a Joomla site if you need it.)

Step 2: Generate a bcrypt hash of your new password

Create a bcrypt hash for the password you want. Two easy options:

• Run this on any machine with PHP:

  php -r "echo password_hash('YourNewPassword', PASSWORD_BCRYPT), PHP_EOL;"

• Or use a trusted online bcrypt generator (for example bcrypt-generator.com) with a cost/rounds of 10.

The result starts with $2y$ - that's a bcrypt hash. Copy the whole string.

Step 3: Paste it into the user's password field

1. Open phpMyAdmin and select your Joomla database.
2. Find the #__users table. Note: #__ is your site's real table prefix (something like ab12x_users) - it is not literally jos_ on modern installs.
3. Browse the table and click Edit on the Super User's row. Not sure which one? Check the #__user_usergroup_map table - the Super Users group is id 8 by default - to find the right user id.
4. Paste your bcrypt hash into the password field, replacing the existing value, and save.

Step 4: Log in and change it

Log in to /administrator with the new password, then go to your user profile and set a fresh password through Joomla itself so everything is clean.

Why the old MD5 trick no longer works

Plenty of old guides (including this site's own previous version) told you to run SELECT MD5('reset') and paste the result into the password field. That was correct for Joomla 1.5 to 3.1. From Joomla 3.2 onward, Joomla uses bcrypt, so an MD5 string will never authenticate - it just locks you out further. Always use a bcrypt ($2y$) hash on any current site.

After you're back in

• Set a strong, unique password.
• Delete any temporary accounts you created to get back in.
• Consider adding two-factor authentication or a passkey so a lost password is less of an emergency next time.