How to Reset a Magento Admin Password
Forgetting a Magento administrator password can prevent you from accessing important store management functions. Fortunately, Magento provides several ways to regain access, depending on whether you can still use the Admin login page, another administrator account, or server-level access.
A password reset should be performed carefully because the Magento Admin Panel controls sensitive store settings, customer information, orders, products, payment configuration, and other important resources.
This guide explains how to reset a Magento Admin password using the built-in recovery option, another administrator account, and the Magento command line. It also covers common password-reset problems and security best practices.
When Should You Reset a Magento Admin Password?
You may need to reset an administrator password when:
- You have forgotten your password.
- A password has expired according to your security policy.
- An administrator is unable to log in.
- A staff member needs a new password.
- You suspect that administrator credentials may have been exposed.
- You are taking over an existing Magento store.
- A temporary administrator account needs new credentials.
If you suspect unauthorized access, don’t simply change the password. Review administrator accounts, logs, active sessions, and other security controls as part of your incident-response process.
Magento Admin Password Reset Methods
There are several approaches to resetting a Magento administrator password.
| Method | When to Use |
|---|---|
| Forgot Password | You cannot remember your password but can receive email |
| Admin Panel | You can access Magento with another authorized administrator account |
| Magento CLI | You have SSH/server access |
| Database | Last-resort recovery when normal methods are unavailable |
The first two methods are usually the simplest.
Method 1: Reset the Magento Admin Password From the Login Page
This is the easiest method if you have forgotten your password and can access the administrator login page.
Step 1: Open the Magento Admin Login Page
Open your Magento Admin URL.
For example:
https://example.com/admin_pathYour actual administrator path may be different.
Step 2: Click “Forgot Your Password?”
On the Magento login screen, select:
Forgot Your Password?Magento will display a password recovery form.
Step 3: Enter Your Email Address
Enter the email address associated with the Magento administrator account.
For example:
[email protected]Then submit the form.
Magento will process the password-reset request.
Step 4: Check Your Email
Check the administrator email account for the password-reset message.
Also check:
- Spam folder
- Junk folder
- Promotions folder
- Mail filtering rules
The reset email should contain instructions for creating a new password.
Step 5: Open the Password Reset Link
Follow the link provided in the email.
The link may expire after a certain period or become invalid after being used.
If the link has expired, request another password-reset email.
Step 6: Create a New Password
Enter a new password and confirm it.
Use a strong, unique password.
For example, avoid passwords such as:
admin123
password123
Magento123
companyname123Instead, use a long password generated or stored by a reputable password manager.
Step 7: Log In Again
Return to the Magento Admin login page and enter:
Username
New PasswordComplete two-factor authentication if it is enabled.
If the credentials are correct, Magento should open the Admin Panel.
What If the Magento Password Reset Email Does Not Arrive?
If you request a password reset but don’t receive an email, check the following.
Check the Email Address
Make sure you entered the email address associated with the administrator account.
Check Spam and Junk Folders
Automated messages may be filtered by your email provider.
Check Magento Email Configuration
Incorrect email configuration can prevent Magento from sending transactional messages.
Check SMTP Configuration
If your store uses an SMTP service, verify that its configuration is working correctly.
Check Server Mail Logs
If you manage the server, inspect the mail logs for delivery errors.
Check DNS Email Configuration
Incorrect DNS configuration can affect mail delivery and authentication.
Method 2: Reset an Admin Password From Another Admin Account
If you cannot access one administrator account but another authorized administrator can access the Magento backend, the password can generally be changed through the Admin Panel.
Step 1: Log In With an Authorized Administrator
Use another administrator account that has permission to manage users.
Step 2: Open Admin User Management
Navigate to the administrator user-management section.
Depending on your Magento version and configuration, this is generally located under:
System → All UsersStep 3: Select the User
Find the administrator whose password needs to be changed.
Open the account for editing.
Step 4: Set a New Password
Enter a new password in the password fields provided by the Admin Panel.
Make sure the password satisfies your Magento password policy.
Step 5: Save the Account
Save the administrator account.
The user can then log in using the new password.
Method 3: Reset the Magento Admin Password Using SSH
If you have SSH access to the Magento server, the Magento command-line interface can be used to manage administrator accounts.
First, navigate to the Magento root directory.
For example:
cd /var/www/htmlVerify that the Magento CLI is available:
php bin/magentoYou should see the Magento command-line interface output.
Use the Magento Admin User Command
Magento provides administrator user commands through its CLI.
To see the available administrator commands, run:
php bin/magento admin:userDepending on your Magento version, available commands can include operations for creating or managing administrator accounts.
For example, the administrator creation command is commonly:
php bin/magento admin:user:createMagento will prompt you for administrator information, including:
Admin user
Admin password
Admin email
Admin first name
Admin last nameCreating a Replacement Admin User
If you cannot recover the original administrator account but still have authorized server access, creating a new administrator account may be appropriate.
Run:
php bin/magento admin:user:createFollow the prompts.
For example:
Admin user: newadmin
Admin password: ********
Admin email: [email protected]
Admin first name: Store
Admin last name: AdministratorAfter successfully creating the account, use the new credentials to access the Admin Panel.
Important
Only create an administrator account when you are authorized to manage the Magento installation. Administrator accounts provide access to sensitive store functionality.
Resetting a Password Through the Database
Directly modifying the Magento database should generally be considered a last-resort recovery method.
Magento stores administrator credentials securely rather than as plain-text passwords. Therefore, manually replacing a password value in the database is not as simple as entering a new plain-text password.
Do not run SQL such as:
UPDATE admin_user
SET password = 'newpassword';This does not correctly create a Magento password hash and can leave the account unusable or insecure.
Instead, use Magento’s supported administrative or CLI mechanisms whenever possible.
Why You Should Avoid Direct Database Password Changes
Magento uses password hashing mechanisms rather than storing administrator passwords in plain text.
Direct database modifications can cause problems such as:
- Invalid password hashes
- Authentication failures
- Incorrect password metadata
- Compatibility problems
- Security risks
- Accidental database corruption
If normal password-reset methods are unavailable, use Magento’s command-line tools or another supported administrative recovery procedure rather than guessing the database format.
Resetting a Magento Admin Password on DirectAdmin
If your Magento store is hosted on DirectAdmin, you can use either the normal Magento password-recovery process or SSH.
Option 1: Use the Login Page
Open:
https://example.com/admin_pathClick:
Forgot Your Password?Then follow the email recovery process.
Option 2: Use SSH
Log in to your server:
ssh username@server-ipNavigate to your Magento installation.
For example:
cd ~/domains/example.com/public_htmlThen run:
php bin/magento admin:user:createIf you still have access to another authorized administrator, using the Admin Panel to change the affected account is usually preferable.
Resetting a Magento Admin Password on cPanel
If Magento is hosted on cPanel, you can use the standard password-recovery process through the Admin login page.
If you have SSH or Terminal access, navigate to the Magento root:
cd /home/USERNAME/public_htmlThen verify the Magento CLI:
php bin/magentoIf server-level recovery is necessary, use Magento’s supported CLI administrator commands rather than directly editing password values in the database.
What If You Forgot Both the Username and Password?
If you have forgotten both credentials, you have several recovery options.
Option 1: Check Existing Documentation
Look in your:
- Password manager
- Hosting documentation
- Deployment records
- Internal administrator records
Option 2: Use Another Administrator Account
If another authorized administrator exists, they can identify or manage administrator accounts.
Option 3: Use Server Access
If you have authorized SSH access, Magento’s CLI can be used to manage administrator accounts.
For example:
php bin/magento admin:user:createCreating a new administrator account may be simpler than trying to recover an unknown username.
What If You Don’t Know the Magento Admin URL?
Before resetting the password, make sure you’re using the correct administrator URL.
The Admin path is configured in:
app/etc/env.phpLook for:
'backend' => [
'frontName' => 'your_admin_path'
],For example:
'frontName' => 'storemanager'The login URL would be:
https://example.com/storemanagerWhat If the Password Reset Page Shows an Error?
Several issues can cause password recovery to fail.
Email Configuration Problem
Magento may be unable to send the reset email.
Check the store’s email configuration and SMTP setup.
Incorrect Administrator Email
The email address may not belong to the administrator account.
Cache Problems
If the Admin Panel behaves unexpectedly, clearing Magento cache may help:
php bin/magento cache:flushExtension Conflict
A third-party extension can sometimes interfere with administrator authentication or forms.
Review recent extension changes if the problem began after an installation or update.
Server or PHP Error
Check Magento logs:
ls -lah var/log/Then inspect relevant logs:
tail -f var/log/system.logWhat If You Get “Invalid Username or Password”?
If Magento rejects the new password, check:
- Username spelling
- Password spelling
- Caps Lock
- Correct Admin URL
- Account status
- Two-factor authentication
- Browser password-manager entries
- Magento logs
If you recently changed the password, manually type the new password rather than relying on an old saved browser credential.
What If the Admin Account Is Locked?
Depending on the Magento version and authentication configuration, repeated unsuccessful login attempts or security controls may temporarily restrict access.
If another authorized administrator can access the Admin Panel, check the affected account and authentication settings.
If necessary, investigate:
- Security extensions
- Web application firewall rules
- Server access controls
- Magento logs
- Authentication configuration
Avoid repeatedly guessing passwords because this can trigger additional security restrictions.
What Happens After Resetting a Magento Admin Password?
After successfully changing the password:
- The old password should no longer be used.
- Update your password manager.
- Test the new credentials.
- Complete two-factor authentication if enabled.
- Review recent administrator activity if the reset was triggered by a suspected compromise.
- Verify that the account has the correct role and permissions.
If the password was reset because you suspect unauthorized access, also review other administrator accounts and security settings.
Magento Admin Password Security Best Practices
Use Unique Passwords
Never reuse the Magento Admin password on another website.
Use a Password Manager
A password manager can generate and store long, unique credentials.
Enable Two-Factor Authentication
Two-factor authentication adds another authentication layer beyond the password.
Avoid Shared Accounts
Each administrator should have an individual account.
Review Administrator Accounts
Regularly check for unused or unexpected administrator accounts.
Use Least-Privilege Roles
Only grant administrators the permissions they require.
Protect the Admin URL
Use HTTPS and consider additional access controls where appropriate.
Keep Magento Updated
Maintain Magento and its extensions according to your supported versions and security maintenance process.
Magento Admin Password Reset Checklist
Use this checklist when recovering an administrator account:
- Confirm the correct Magento Admin URL.
- Try the Forgot Your Password? option first.
- Check the administrator email inbox.
- Check spam and junk folders.
- Verify Magento email/SMTP configuration if the email does not arrive.
- Use another authorized administrator if available.
- Use Magento CLI when server access is available.
- Avoid manually replacing password values in the database.
- Create a backup before making server-level changes.
- Test the new password.
- Update your password manager.
- Enable two-factor authentication.
- Review administrator accounts if compromise is suspected.
Frequently Asked Questions
How do I reset my Magento Admin password?
Open the Magento Admin login page, select Forgot Your Password?, enter the administrator email address, and follow the password-reset instructions sent by Magento.
Can I reset a Magento password using SSH?
If you have authorized server access, Magento’s CLI provides administrator-management commands. You can use these tools to manage administrator accounts without directly modifying password hashes in the database.
Can I reset the password from another Admin account?
Yes. An authorized administrator with appropriate user-management permissions can edit the affected administrator account and set a new password.
Where is the Magento Admin password stored?
Magento does not store administrator passwords as plain text. Password credentials are stored using password hashing, so you should not expect to find a readable password in the database.
Can I change the password directly in MySQL?
Directly replacing the password field with a plain-text value is not a valid Magento password-reset method. Use Magento’s Admin Panel or supported CLI tools instead.
What should I do if I don’t receive the password-reset email?
Check your spam folder and verify the administrator email address. If the message still does not arrive, investigate Magento’s email configuration, SMTP service, and server mail logs.
Does resetting the Admin password change the Admin URL?
No. The administrator password and Admin URL are separate configuration elements. Resetting the password does not normally change the administrator path.
Should I reset all administrator passwords after a security incident?
If you have reason to believe administrator credentials may have been compromised, password changes may be part of a broader incident-response process. Review all administrator accounts, authentication settings, logs, access controls, and other potentially affected credentials.
Final Thoughts
Resetting a Magento Admin password is usually straightforward when the built-in Forgot Your Password? feature is available. If email recovery is not possible, an authorized administrator or server administrator can use Magento’s supported account-management mechanisms to restore access.
Avoid directly writing plain-text passwords into the Magento database. Instead, use the Admin Panel or Magento CLI wherever possible.
Once access has been restored, protect the account with a strong unique password, two-factor authentication, appropriate permissions, and regular administrator-account reviews. If the password reset was caused by suspected unauthorized access, investigate the broader security situation rather than treating the password change as the only corrective action.