Introduction

Changing a WordPress user’s password directly in the database is sometimes necessary, especially in cases where admin email access is lost or user accounts are compromised. This guide walks you through the process using phpMyAdmin and its own built-in MD5 function, so the password is never typed into a third-party website on the way.

Why Change Passwords via the Database?

  • Access Issues: Essential for situations where password recovery via email isn’t viable.
  • Immediate Results: Direct database edits take effect immediately.

One important limit before you start. Changing user_pass with a raw database edit does not sign anyone out. WordPress keeps login sessions as tokens in wp_usermeta under session_tokens, and only the proper functions clear them, so anyone already signed in as that user stays signed in. If you are doing this because the account was compromised, the new password on its own does not remove the attacker. Clear that user’s session_tokens row as well, or run wp user session destroy <user> --all if you have WP-CLI.

  • Administrative Control: Allows quick recovery and securing of accounts in the event of security breaches.

Precautions Before You Start

  • Database Backup: Always back up your database before making changes. This protects you against potential data loss.
  • Secure Connection: Use a secure connection to access your hosting control panel to avoid data interception.

Step-by-Step Guide to Changing a WordPress Password in the Database

1. Access Your Database

  • Log into your hosting account and navigate to phpMyAdmin.
  • Select the WordPress site’s database.

2. Find the Users Table

  • Open the wp_users table, typically listed directly in the database, to view all user accounts. The wp_ part changes if the site was installed with a different table prefix, so check the name before assuming.

3. Edit the User’s Details

  • Identify and locate the user account needing a password reset by their user_login.
  • Click the Edit button for their row to modify their details.

4. Generate your password

Do not paste the password into an online MD5 generator. phpMyAdmin will hash it for you, and typing a password you are about to rely on into somebody else’s website is exactly the habit to avoid.

In the row editor, find the user_pass row and choose MD5 from the Function dropdown beside it. phpMyAdmin applies the hash itself when the row is saved.

5. Save the Changes

  • In the user_pass value box, type the new password as plain text, with MD5 still selected in the Function column.
  • Save your changes by clicking the “Go” button in phpMyAdmin.

Testing the New Password

Try logging into the WordPress dashboard with the new password to confirm it has been set successfully.

Important Tips

  • Security Caution: MD5 is not what WordPress uses. Since WordPress 6.8 passwords are hashed with bcrypt, and with phpass portable hashing before that. An MD5 value is only accepted as a legacy fallback when logging in, it carries no salt, and anyone holding a copy of the database can reverse an ordinary password from it in seconds. Treat whatever you set here as a temporary password, not the one you keep.
  • Enhance Security Post-Access: Log in as soon as you have made the change. WordPress rehashes the password with bcrypt on that first successful login, and setting a fresh one under Users, Profile replaces the temporary password properly.

Alternative Solutions

If you do not have access to the website’s database, there is another way around being locked out. You can create a new admin user through the files of the website to regain access. You can read our guide here.

Conclusion

Directly changing a user’s password in the database is a powerful tool for WordPress administrators, especially during access emergencies. By following these secure and straightforward steps, you can ensure the integrity and safety of your WordPress site.

Being locked out is often a symptom rather than the problem, particularly if it followed a failed update or a compromise. Both are the sort of thing our WordPress fixes and repairs work covers, and keeping a site patched and backed up through a maintenance plan is what stops it happening twice.