Joomla - How to Reset Super Admin Password
How to Reset Your Lost Joomla Password in 6 Easy Steps
Before we begin, you must have access to your database. If you don't, pass these instructions on to someone that does. It's also a good idea to backup your database before making changes, just in case something goes awry.
Finding the Password
- Log in to your Joomla database (via phpMyAdmin for example)
- Click to edit the _users database (will be preceded by your account name, for example: example_users)
- Edit the entry for where usertype = "Super Administrator" (should be the first record)
Resetting the Password
In the password field you'll notice a string of characters. Joomla uses a one-way encoding method, which means you won't be able to retrieve your old password. However, you will be able to reset the password to a new one using mySQL's built in MD5 function:
UPDATE example_users SET password=MD5('new password') WHERE usertype = "Super Administrator";
Voila - you just successfully reset your Joomla password :) Go to your joomla domain at example.com/administrator and try logging in with the new password. You should be logged in as Super Administrator.
Reset Using cPanel
For those not familiar with mySQL, you should also be able to login with cPanel, click on the "SQL" tab, and enter the above query there.
Copying the Password from Another User
An alternate method to reset your password, if you're not comfortable with SQL commands, is to simply copy and paste the password hash from another user (to which you know the password) over to your admin user. You'll then be able to login as the admin user using that password. If you don't have another user, you should be able to register as one, and then copy the password over.
Applying the Email From Another User
Yet another alternate method to retrieving your lost Joomla admin password is to change your admin user's email address to one you are familiar with. Then use the lost password retrieval function (the "forgot password" link in the login section) to have your Joomla password emailed to you.
Troubleshooting
Thanks to feedback from our web rockers we've been able to add various user based suggestions in addition to our own. Please use caution when trying these optional suggestions!
AlphaNumeric Only
If for some reason the above method does not work try encoding a password that contains only alphanumeric (a-z, 0-9) characters. This method may not work if your password contains special characters (@!#$).
Joomla User Plugin
Another possible reason that you're unable to login is that you may have inadvertently deleted the Joomla User Plugin. You can remedy this by logging into you backend, and locating the jos_plugins table in your database. Edit this entry and set the published status of user joomla to 1 (enabled). Once you've done this, try logging in again.
Temporarily Remove PHP Authentication
This is another potential approach you can use to recover your Joomla admin password, but proceed with caution. Also note that this has only been tested in Joomla 1.5. Locate the file plugins/authentication/joomla.php, and change the line
if ( $crypt == $testcrypt) {
to
if ( $crypt == $testcrypt || $_SERVER['REMOTE_ADDR'] == "Your IP Address") {
Replace "Your IP Address" with your IP address (your IP address is: 38.107.179.227). Now anyone from your IP address (ie. your PC or local network) can login with any password. After logging in and changing your password, remember to restore the original code.
Can't Login and No Errors
If you can't login and Joomla is not giving you any error messages, it could be that your sessions directory doesn't have the correct permissions. They should be set to 755 (you can login via FTP, find your sessions directory, and adjust the permissions (CHMOD)).
Invalid Session Error
If you're getting an invalid session error when you try and login, you probably need to clear your browser and or site cache and cookies. Refer to our browser cache clearing instructions for details on clearing the cache your browser. For Joomla, you can clear the cache tables in your database (if you were able to login, you could browse to Tools > Clean Cache).
How to reset Joomla 1.5, 1.0 and earlier passwords
In each of these examples you'll want to follow the above instructions, but then modify your SQL query to the following, which will reset your password to the one you specify.
UPDATE `jos_users` SET `password` = MD5( 'new password' ) WHERE `jos_users`.`username` = "admin";
If this doesn't work, try changing jos_users to mos_users.
Joomla: Evolution of a CMS
Joomla is one of the world's premier open source CMS (Content Management System). It's competitors include WordPress (which began as a blogging platform but has since grown into a full-fledged CMS thanks to all the plugins developers have created), Drupal, TypePad, and others. Drupal probably most closely resembles Joomla's overall structure and functionality, although Drupal tends to be a lot more robust and powerful, while Joomla is known to be more user-friendly and attractive right out of the box.
To find out more about either CMS, simply search We Rock Your Web for keywords "Drupal" or "Joomla" and you'll find articles that have been written by our web rockers.
The Ultimate Guide to Joomla - Step by Step Joomla Videos
Want to become a Joomla master in a day? There are a growing number of free Joomla videos available on the Web. Many feature a complete video based Joomla learning system that allows you to master all the basic as well as some advanced functions of Joomla in under a day. That means you won't have to spend your time Googling for solutions to problems such as this one, having lost your Joomla admin password.
In the available Joomla videos, you can also learn about:
- Joomla SEO
- Joomla membership-based sites
- Automating the backing up of your Joomla database
- Joomla template design and extensions
As it's all video based, you simply sit back and watch it on your computer right away. You can also watch the construction of a sample Joomla site, built step by step from scratch. You can pause the video, and follow along step by step if you wish.
Print
PDF
Email
View Comments
Post a CommentBeing locked out is very frustrating.
As the author correctly points out, one of the most frustrating things that can happen to a website owner is either being locked out of their own site or database system, or not knowing how to reset a password. This article is a very thorough guide to doing just that- resetting your super admin password within your Joomla content management system.
The super admin password is the main daddy. This is what gives you access to everything in the account. If this were to become lost then most people would have a heck of a time trying to get back into their account. Actually, though, the author gives a lot of different tips and tricks for finding it listed right in your database.
I must confess that I am not a Joomla user. But I still found it interesting to see how one would go about locating and then changing this password. I am familiar with how to do this in a number of other content management systems, and this is a little different. There are actually several different ways or approaches one could take to reset a lost password.
The first way is likely the easiest and the most direct method. Generally speaking, if it is easy and direct, this is probably where you should start! The only thing is that this assumes you have access into your database. That may be a problem, given the fact that you are looking to reset a lost password. However, I assume that any good web owner will certainly give themselves a back door way into the site. So, OK, you can get into your account. The author gives a very clear method of actually locating the password (it should be the first entry under the edit users database).
Once again, resetting the actual password is a very simple process. The author even gives you the exact command and line of code needed to use in order to accomplish this task. These actual step by step directions are incredibly helpful. They are the best pieces of information which the author provides.
Honestly, the coding is quite interesting to me. I am not sure if many other readers will share my opinion or not, but I love trying to figure out how something works. This is especially true if it is internet or technology related. The code shows me in detail how the Joomla system is similar and different to other systems that I am used to working with.
In addition to all of this, the author also provides readers with several other suggestions and “optional” ideas which may work, although caution is advised. The main thing to remember about Joomla is that there is always something being added to the program, which means that tomorrow there may be an even easier way to solve a common problem. This makes Joomla such a cool platform to use for web development.
More easy ways to change or reset password in Joomla
There are several additional easy ways to change or reset a password in Joomla. This platform is actually pretty easy to get into and work with. This was one of the biggest surprises for me personally. I began to design and build web pages and sites in the era where coding was regarding as the standard requirement. Everyone who was worth anything (in terms of web design skills) needed to know how to code. Also, this was during the days when it was hard coding. We literally spent days pouring over books learning the commands to do even the most basic tasks. Believe it or not, I miss those good ole days!
Of course, today all this has changed. There is now no need to learn actual HTML or any other programming language. You just simply need to master some software programs. Learn Dream Weaver and you can create as snazzy a web page as any master coder of years past. Not only that, but you spend one heck of a lot less effort in doing so.
The author also points out that you do not even have to log into your account directly. Instead, try clicking the MySql button. This will get you access very quickly. From here, you can easily find the lines for your password and reset this.
On the other hand, if you are not comfortable with using SQL commands, you can try an alternative method. Actually, there a couple of neat little tricks you can try here. The first is to copy and paste the password hash (I am not familiar with what exactly the password hash is, but I gather most Joomla users are) from another user over to your admin account. I gather that this is basically logging in to the account as another user. So, this means that another user would be able to reset the admin password.
Honestly, this seems a little strange to me. Actually it seems a bit unsecure. I would not want to have any user be able to see or (if they cannot see) and reset the master password. Perhaps it would a good idea to make this option available for one or two key users, but definitely not everyone.
Another trick that I actually like is to change your admin user email address. Change it to one that you are familiar with and can access, obviously. Then, you can use the forgot password function to have it sent to your new email address, which should now be registered. I like this trick. Of course it is a way to game the system, and probably speaks to the fact that is a bit less secure than many would like, but it still works.
You may also want to try reloading or reinstalling the Joomla user plug in. Get into to the back end of your account and then find this plug in and set the published status to 1. This status means that it is enabled.
Password Reset Made Easy
I must confess that I am not a Joomla user, so this article may not have really been targeted to me specifically. However, I am a website owner and developer. Therefore, I am a little familiar with what Joomla is and understand a bit about what the author is trying to accomplish here. Essentially, there are a number of different ways and things that can be done if you need to reset your administrator password.
For the uninitiated, this super admin password is the big daddy of them all. This is the one that grants access to everything on your Joomla site. If you were to lose this or forget it, you would have a pretty interesting time trying to get back into your database. By interesting, I really mean not much fun and a whole lot of frustration. Yeah. THAT kind of interesting. Interesting meaning like you have a client screaming at you at 2 am because their site is down (one of the ones that you are hosting on a site where you have lost your Joomla password). Trust me, I do not care how good their technical support staff is, being wakened from a dead sleep and then having to call some rep in India for help (when you are already frustrated no less), will drive almost anyone to start drinking!
Actually, I think the best tip was given right up front. Back up your database. We all know that this only makes sense. Yet, very few of us ever do. Maybe we are all just lazy? Or we all think that there will never be a disaster or a problem? Personally, I have experienced a number of really difficult times with data. Those times when I had back-ups made everything so much easier. Trust me, you will a lot more relaxed knowing that you just need to push a few buttons and everything will be fine again.
The next tip for resetting the password is also quite basic, but accomplishes the job. You simply need to get into your database, either yourself or someone else. This assumes that you still have access to the password. Apparently, finding the password from this point is pretty easy. You click to edit the user database and then the next entry should be where you will see the super administrator password.
From here resetting your password is quite simple. The article actually provides a single line of code that should be used to accomplish this. To be honest, the whole process was much easier than I thought it would be.
I had always thought that Joomla was a powerful platform for managing your content. This may be why it is even called a CMS, or content management system. Yet, still I had envisioned this to be a highly technical process. I thought that getting involved in this would mean having to learn code and maybe even become a programmer. I was quite happy to discover that this was not the case.
How Can I find out the Super Admin Password if No One Has it?
I have a new job and my job is to work on my organization's website. However, no one in the office knows the super admin password because the person who set the account up is no longer around. The only information they do have is how to login to the front door not the back door. I have absolutely no idea how to retrieve the super admin password. I have the username and password but no other information. I think he worked on the website in a different office so my office computer didn't have joomla installed on it or xampp or anything. I downloaded xampp and joomla but i can't access the admin panel to make changes.
What do i need to do?? Please help.
Access to Joomla database
First off, when you say you have the username and pw, which username and pw do you have? (I'm assuming not the one for Super Admin 
The article above illustrates several different methods to restore your super admin password. You'll most likely need to access your Joomla database on the backend. Do you have the access credentials necessary to get there (ie. via cPanel)?
Can't Login and No Error Messages
Hello friends,
I have this problem of can't login and no error message. I have reset my admin password, created new admin and still can't login.
I also to use the adjusting the permissions of sessions directory, but not find any sessions directory in my account.
I run Joomla 2.5.
Hope to hear from you again.
Thank you.
Roy!
Your webpage may already be
Your webpage may already be hacked. Please use firebug to check for any inconsistencies between your fresh Joomla file and your webpage.
My webpage also had some hidden Javascript and iframe which caused the same problems as yours.
worried I may have been hacked
Reading these posts, I am getting the feeling my site may have been hacked.
I am a novice and use joomla because it is easy to use. When logging into my admin panel, i get the message "You do not have access to the administrator section of this site". I have been into cpanel users and can see that I am still a super administrator. When i use an incorrect password i get the message "username and password do not match". I changed my password and still get the message "You do not have access to the administrator section of this site". Is there anything I can do?
Go easy on me, I am not that technical other than being able to access cpanel, see users, and access and update joomla content.
How to reset Joomla admin password
I have lost my super administrator password in Joomla.
Joomla admin pw retrieval
Awesome - I was able to retrieve my Joomla administrator password and an now back in my website! Thank you thank you thank you. The only thing I can think of that would make this article more useful would be to organize it by Joomla versions, and have a quick overview of the most effective method to retrieve or reset the administrator pw.
Login as Administrator means
Login as Administrator means you have all the rights to do any thing in the windows without any restrictions.Let us suppose you are logged in as a guest user that means having low privilages and in your guest user these privileges are defined/set by the administrator and you may not be able to delete, install or download any thing without your administrator permission. If you install or delete some thing it may ask you for the administrator password to do so.
some times while working on Excel or Word due to some problem your file or backup files get crashed and there is an option to send this problem to the Microsoft team so that they can resolve it or they can update their error database if this is a new type of error which has never occurred before.
Techyv.com
Reset forgotten root password
If you have access to the Linux server you can directly change the pw using Grub or the Linux boot CD.
It was a redirect that caused my login problem
Symptom: Entered correct username/password - Login page just kept re-displaying - no error messages, nothing.
Cause: I had put a rewrite statement in my .htaccess file to redirect mydomain.co.uk/index.php to mydomain.co.uk - this statement was causing my mydomain.co.uk/administrator/index.php to get redirected to mydomain.co.uk/administrator so it never ran administrator/index.php to do the logon
Solution: First removed to prove this was the problem, then recoded the rewrite statement in my .htaccess
Thanks for sharing
Very interesting, wouldn't have thought to check rewrite statements. Thanks for taking the time to share your experience and solution with our readers. Hopefully someone else will benefit from your knowledge.
Can't edit text in Joomla
I successfully changed my super administrator password in Joomla two days ago, but now when I edit my text in Joomla such text does not reflect on my site. Please help!
Thank you!
Wow! It worked! A huge huge thank you!!!!
Joomla password reset
I cannot reset the admin password by following these steps. Maybe I am doing something wrong? Can you help please?
Joomla password troubleshooting
Can you describe what you've tried and where you're getting stuck/ what's not working? Then I can help troubleshoot your problem.
I forgot the process
I had forgotten how to reset my Joomla password. Thanks for the reminder!
Still can't login in backend even after typing 100% username/p.!
Great article, it helped me a lot. After temporarily removing PHP authentication I managed to login to the backend successfully and I changed the password correctly. But, after I had restored the original code and then logged in again I received the message "Username and password do not match."
I tried all the options mentioned above but I just can't find a solution ;(
Any help is appreciated and many thanks in advance!
Cheers,
Adi
Is Joomla Authentication active?
Another possible cause of being locked out can be if the Authentication - Joomla plugin is deactivated (unpublished). This produces the same error message as wrong uid/pwd.
In this case the problem can be fixed in the ..._plugins table, setting published=1 where name is 'Authentication - Joomla'.
Thank you!
Excellent advice, thanks for sharing this with our readers 
Joomla password reset
I had a similar problem but solved it in very simple steps:
- Get a new password in plain text (please don't forget it).
- Use an MD5 password converter to encrypt it.
- In PHPMyAdmin (described above) replace the string of characters with your new encrypted password (ie. edit it then save it).
- Go back to the Joomla site and login with your new password.
It worked for me!!!
Can't login on my admin, but able to login on Cpanel!
Hello,
My name is Matt, and recently I bought a site from a client who is not answering to me.
My problem is that I don't know the way to login to my admin, for example : www.example.com\administrator - but when I type this it's says "page not found." And I have to add something to the site asap.
I have my Cpanel login details, but honestly I don't know how to find the admin details.
Thx!!
Joomla website?
Hi Matt,
Is your website running Joomla? Try getting in touch with your hosting provider and see if they can give you access. If not, contact us and we'll try and help you troubleshoot.
I lost pass admin Joomla 1.5 can you help me
I lost the password to my admin account in Joomla 1.5. Can you help me? My host is http://**. Password: **. User: **. Website: **.com.
Use article tips
Try using the methods above to recover your Joomla password/ regain access. And please, don't post your login details in the comment section where everyone can see them.
Good luck - let us know how it goes!
Joomla Administration Login Problem
Hi;
This is my second email to you. I followed all the below mentioned steps but still i am not been able to login inside joomla panel. I spend many days for this but still not been succeed. I wonder if you have any other solution :-
Suggestion n.1)
edited the file administrator/components/com_login/admin.login.php to comment out line 69 (//LoginController::display() )
browsed to the login page.
[tried to login] and got an ‘Invalid token‘ message.
Reedited the [administrator/components/com_login/]admin.login.php file to remove my comment at line 69.
Refreshed the login page in my browser and got the normal login form.
Logged in [successfully].
try this and if it doesn’t work, then:
Suggestion n.2) [user inoxfire]
edit file administrator/components/com_login/admin.login.php [to comment out line 57, // JRequest::checkToken('request') or jexit( 'Invalid Token' );]
browsed to the login page.
[tried to login] and got an ‘Invalid token‘ message.
Reedited the [administrator/components/com_login/]admin.login.php file to remove my comment at line 57.
Refreshed the login page in my browser and got the normal login form.
try this and if it doesn’t work, then:
Suggestion n.3)
Log into phpMyAdmin and navigate to the jos_plugins table.
Look for the "User – Joomla!".
Ensure that it is published as mine was not (set published to 1 just in case).
[Look for] in row "Authentication – Joomla"
Ensure that it is published as mine was not (set published to 1 just in case).
try this and if it doesn’t work, then:
Suggestion n.4)
first check your Super Admin status:
[Open PHPmyAdmin] in the "jos_users" table set SuperAdmin to:
– field "id" – value "62"
– field "gid" – value "25" or "26".
in the "jos_core_acl_aro" table find row for "62":
– field "id" – write this down (should be 10 normally) – this is the "aro_id".
in the "jos_core_acl_groups_aro_map" table find row for "aro_id" = 10
– "group_id" should be "25" or "26".
BONUS:
If, for some reasons, you need to reset your joomla! admin password, or if you need to offer admin access to somebody else, or for whatever the reason, please change it by doing so:
Open PHPmyAdmin.
access your joomla DB and goto table jos_users.
modify "admin"-row and set it’s password code to this: 21232f297a57a5a743894a0e4a801fc3 (it’s the equivalent of ‘admin‘).
Looking forward to hear from you.
Thank You
Ujjwal
Well this isn't my joomla
Well this isn't my Joomla problem right now but I've come across this page in the hunt for a solution to my problem (I have a building supplies site and Joomla freezing up on a certain page). I'm pretty sure I'm going to need help with this situation at some point so I am bookmarking this because if I need to reset the admin password I can jump straight to this.
Hi, thanks you saved my life
it works Thank you again!
Joomla 1.0 "Invalid Session" error
I successfully changed admin password from the Joomla 1.0 backend, but I have not managed to login back in again. I get the error "Invalid session"! Any help please?
Joomla on son's PC
I can't do anything since I used Joomla on my son's computer. For some reason it works on my login password for my computer. How do I delete both. Because then I will reset them.
How to Login to Joomla Website
I discovered a great video that shows Joomla Novices how to login to the back end of a joomla website. It can be found at this link. Hope that is helpful.
Reset Joomla Password
Thanks a bunch! Saved my big a**!
Password Genius
Last week my parents changed my password, which was really annoying. I tried to get it back. My computer is Win XP and at first I tried the ctrl+alt+del+del thing but it said it can’t do it because of ‘account restrictions’. Then I went for help in a forum and they told me to download the software Password Genius. It’s quite easy and I recovered my password at last.
Maybe you have to empty your cache
I don't like to verify my way, because I'm glad it worked somehow, and it would be time expensive to test each possibility again and again.
But a small hint, if everything else has failed: I tried nearly anything above with no success.
Then I changed my browser. I tried with opera in the first with bad luck. I switched to Firefox - and surprise (me stupid -beep- had forgotten) , there was the old password stored. (yes I know, that's funny)
Now the biggest surprise, although I have changed the db entry of the password, I could login with the old password stored in my Firefox.
My guess: you have to rebuild your cache if you make a change in your database.
I hope that this was useful to someone.
Best regards,
yours-truly.de
Joomla Password
Using phpmyadmin, I reset the password using this SQL statement
update jos_users set password = md5("password") where username = "admin";
The value of the password field in the jos_users table became 5f4dcc3b5aa765d61d8327deb882cf99
I could login using this value.
However when I entered Joomla using another super admin account and changed password of admin in user management to the same string "password".
The value in the jos_users table became
1270a4c8bb19aacd1b5e307c9dd4cf33:ZfZ0jpWdrTrqAKnJyfVrBrvCcoBqynSG
The hashed pattern was much longer and I could also login using this value.
I noticed this value changed when I repeatedly perform the change password process inside Joomla.
Can anyone tell me why this happened?
It's in encrypted format.
It's in encrypted format. Change to md5 and then use.
Successfully recover my admin password
Joomla 1.5 and latest generates a random salt for each password. Your password in database will be like this: encryptedpassword:salt
so u need to encrpyt your password with the salt and replace it in your database
I have successfully done it before. So this is a few steps how i recover my password:
1. go to phpMyAdmin and find table name='jos_users'
2. browse and click edit button for user name='Administrator'
3. the password field will be=(encryptedpassword):(salt)
4. copy (salt) and you need it to generate encrypted password
5. make new php file and paste this code into it:
$salt="paste your salt here";
$crypt=md5("type your new password".$salt.":".$salt;
echo $crypt;
?>
6. then view your php file in localhost or online web server.
7. copy all encrypted password and paste it in password field in table 'jos_users' which name is Administrator
8. or simply use this sql command and run it:
UPDATE `jos_users` SET `password` = 'your new encrypted password' WHERE `jos_users`.`name` ='Administrator';
that's all.thanks.=).sorry for my broken english.ada aku kisah??lol.=)
Hashed username and password
Your first hashed value is simply the password. The second one consists of a username and a password, in the form username:password.
Changing the super admin password in Joomla
After reading this what I did was go to my site and register as a new user (for example, JOHN) with a password that I will remember. Then I went to my PHP admin and the user part of my Joomla installation database.
I clicked edit user JOHN and copied the entire string in the password box. Then I clicked the back tab in my browser. Next, I went to my super admin and clicked edit and on the password box cleared the string and pasted the JOHN password I copied. Finally, I went to my admin and logged in using the new password and voila, I was in my admin again.
If you try this and it fails drop me an email rokwama at gmail dot com and I will try to help (www.tips.rahatechnologies.com).
Probably old news
I tried everything above for two days with no success. It wasn't until i went to reinstall that i noticed my .htaccess was changed to htaccess.txt, (don't know if it was a theme or plugin). I changed it back & previously reset pwd in phpmyadmin. All good now!
Joomla password security
My friends gmail account got hacked months ago because she had a password with a bunch of numbers. Then she resets her password to a more secure password with a combination of numbers, letters, and special characters. Of course - she can't remember this password, so proceeds to restore the old one, thinking no one will hack in again. Oops - less than 48 hours later the account gets hacked again.
So my question - how does the security of a gmail password, which is a common email service, relate to the security of a Joomla password? Can I have my password be a bunch of numbers or do I need to create a super secure password that is non-dictionary word, letters, special symbols, etc.?
Security does not just reside
Security does not just reside in the actual password, though it does play a big part. I do not know about Gmail's way of securing accounts, but I do know that Joomla is in no way secure without the proper knowledge of security itself. I'll get to that in a bit.
Unless I knew of who cracked the password or how the password was cracked on your friend's Gmail, I can't explain the similarities. In fact, there really is no way to compare the two, in my opinion. Every server and website is differently setup, and has completely different code. Also, it would be helpful to know what browser your friend was using. If the connection to Gmail wasn't secure, through SSL, then that would seriously compromise your password. As I said, security does not only have to do with the password itself. If your friend did not have a secure connection, then it wasn't encrypted, meaning that anybody on your friend's network or even the Internet (with proper tools) could see her password clearly. But, even with encryption, there's a possibility of someone brute-forcing the password, in which case, whether they obtain the password depends on how secure your password is.
Of course, secure passwords need a mix of numbers, letters (both capital and non-capital), and symbols (alt-characters are the best, but I don't know if your Joomla installation is set up to allow those in passwords...you need a Unicode setting on your database). But, you also need to keep in mind that brute-forcing is usually able to crack any password up to 15 characters, so 16 or more is ideal. Also, the best secure passwords don't have any words, ID numbers, or dates, as that can compromise your password to hackers that can look up that information.
So, to answer your question, yes, you do need to create a secure password with those characteristics, but on top of that, you need to make sure your server is secure. Joomla administration, for instance, should never be running without SSL encryption. Talk to the host or server administrator about how to set that up. One last thing, make sure that you limit what plugins/components are installed on your Joomla website. Look them up on the Joomla vulnerable extensions list: http://docs.joomla.org/Vulnerable_Extensions_List
The best security is re-writing Joomla's code, in my opinion. The base of Joomla attacks, is the code itself. If common things in the code are changed, (value names, class names, etc) then a hacker's tool can't tell what CMS you have, thus it fails to hack.
My advice, encrypt with SSL, search around Google for ways to secure Joomla, maybe even changing the Super Administrator account.
Good luck!
Thank you so much!!
Wow, this is very helpful advice indeed. Thank you so much for taking the time to write such a helpful and extended explanation of Joomla security, and security in general.
I will look into setting up SSL on my Joomla server, and maybe even switching my CMS to a different system, such as Drupal.
How secure is Drupal, compared to Joomla, in your opinion?
Forget my last query for
Forget my last query for exact wording about the password. I have figured it out.
Script to change password
I am having trouble getting this changing of the administrator password to work and get error messages. I have copied and pasted your whole string and tried the password various ways. I have cut some words off to see if that would do it, but did not get it. Here's the last attempt:
SET password=MD5(slowcow) WHERE usertype = "Super Administrator"
What exactly would you type in if you are trying to use "example" as a password. ( I will change later)
thanks
thank u bebeh...u make my job done! walah!!!
Reset Joomla Password
This is just what I was looking for. Nice to know there are so many different ways to reset your Joomla password. Considering how easy it is to lose a password, it's nice to have options handy.
Bottom line I need to find a better way of storing passwords. Does anyone have a recommendation? Maybe a password file?
Joomla Rocks
I love working with Joomla - it's by far the easiest and most robust CMS out there. The admin panel is a breeze, article posting is super easy, and with all the available modules - like CB and Virtumart, there are few limits to what you can do in Joomla.
Awesome
Thx, I just created a new user as advised above, then copied the password hashes back into the super admin.
Awesome
thx Dude
Back in Joomla
Fantastic - the MD5 method (using the MD5 has for "admin") above helped me get right back into my Joomla website. Now I just need to remember to change my password back!
Still unable to login
Hi Folks,
First of all thanks for your effort in letting us know how we might be able to reset the admin password. However, I can't get it to work. Basically I tried all the tricks and tips you've given but have not had any success so far. Here is what I did:
First I tried the UPDATE `jos_users` SET `password` = MD5( 'new password' ) WHERE `jos_users`.`username` = "admin"; command, as I am running the latest 1.5 version of Joomla. After that I tried this one:
if ( $crypt == $testcrypt) { so that it reads:
if ( true /* $crypt == $testcrypt */ ) {
and Joomla still wants to have a password. And if I say i.e. blablafoo I still get that Authentication Error. Well, I then tried the first recommended Update Version:
UPDATE example_users SET password=MD5('new password') WHERE usertype = "Super Administrator";
And still no success! It is a local installation with the latest XAMPP on a Win/Professional System. So, has anyone some more ideas, am I having a rights issue? I simply got stuck and hope that one of you might kick me off the horse! Thanks a lot for your highly appreciated help!
Regards
Niels
2 years on Jack still rocks!!!!!!
I had my passwords written down but could not gain access any way. Tried 6 sites and none of the solutions worked.
Then did what jack said and it worked!!!!!!
Thanks jack!!!! Your one minute posting has helped many people all over the world for years!!!!!!!
Thanks! You saved my a__ big time :)
Worked like a champ.
Can't login
I have been getting the error message "Username and password do not match"
I have tried Jack's solution to modifying the joomla.php file and that has produced no effect. (and I have used this in the past on another site)
I have checked the configuration.php file and confirmed I am using the correct password.
What can I do?
You may have deleted JOOMLA USER PLUGIN
You may have deleted JOOMLA USER PLUGIN.
To enable this plugin from backend. Goto your Joomla database. Locate jos_plugins TABLE, then set the PUBLISHED status of USER JOOMLA to 1 (i.e enabled). Then you can relogin or tried other password reset suggestions. That should solve your problem.
Olatunde-Hythe
www.Xybertek.com
Thanks a Trillion mate
Thanks a Trillion mate. I could kiss you. I'm never touching the plug-ins again.
THANK YOU
I spent 2 hours in Joomla forums trying to reset my password with no success, and setting the Authentication - Joomla to 1 finally was the solution. You guys are awesome, keep doing what you're doing, thank you.
Hi I tried exactly what you
Hi, I tried exactly what you suggested, but this didn't work. So instead of User Joomla I noticed that Authentication - Joomla was set to 0. I changed this to 1 and I was able to get back in. Your post put me on the right track so a big thank you for that! Colum - quinncolum at hotmail dot com.
Thanks a million times
you saved my life..
i did exactly as you explained..
now i m able to login
thanks alot
Doesn't work?? maybe this is a simple solution
I had the same problem, it was the Joomla user plugin which was disabled!
This one's the winner for me!!
After beating my head against the screen and mouthing insanities about phpMyAdmin passwords that I couldn't remember I found this (on this very page):
Submitted by a visitor from afar on Fri, 2007-08-31 08:09.
By temporarily removing the authentication in PHP, you can let anyone login. So, in Joomla 1.5 RC, you can go to plugins/authentication/joomla.php and modify the line:
if ( $crypt == $testcrypt) {
so that it reads:
if ( true /* $crypt == $testcrypt */ ) {
Now everyone can login with any password. Change your password to something that you can remember. Do not forget to put the original authentication code back in.
Jack
www.jackbriner.com
Thanks heaps Jack! You saved my bacon!!
The best of all!!
This solution worked for me after trying many of the mentioned tricks.
Thanks a lot.
Knoble
Admin Login does not work
Hello Jack,
I tried to follow your steps and did exactly what you have mentioned but still it's not working. This is the code I used:
if ( true /* $crypt == $testcrypt */ ) {
$user = JUser::getInstance($result->id); // Bring this in line with the rest of the system
$response->email = $user->email;
$response->fullname = $user->name;
$response->status = JAUTHENTICATE_STATUS_SUCCESS;
$response->error_message = '';
} else {
$response->status = JAUTHENTICATE_STATUS_FAILURE;
$response->error_message = 'Invalid password';
}
2nd Solution:
I changed the password from jos_user and tried to login as the administrator, but even this did not work.
3rd Solution:
I went through user_plugin and the numeric value given is 1.
4th Solution:
I changed the below code again in order to work through the IP address but that did not work as well. One more thing - I cleared all the cache and deleted the history of my browser too.
if ( true /* $crypt == $testcrypt */ ) {
$user = JUser::getInstance($result->id); // Bring this in line with the rest of the system
$response->email = $user->email;
Following all the above steps I am still not been able to login inside the panel.
Looking forward to hearing from you.
Ujjwal
Thanks thanks and thanks again
Super Jack... Very helpful
Johan
This one's the winner for me!!
It is better to replace:
if ( $crypt == $testcrypt) {
if ( $crypt == $testcrypt || $_SERVER['REMOTE_ADDR'] == "your ip address") {
Only the people with that IP can login to your system.
password update..
simple logic, but didn't come to my mind.. u saved my day ..Thanks
Doesn't work
According to MySQL this is wrong.... this is useless information.
Specific problem?
Would you care to go into detail? Works for us and appears to work for most of the people visiting this page...
Lost joomla admin pw, none of these answers work
OK, thanks but after careful reading and changing the password for the super admin and even adding a new super, none of the MySQL entered passwords work.
I have full MySQL access and ftp access...how do I go in and do serious surgery?
There was a method in 1.5RC to make it possible to enter any password and get in. I am in 1.5.12, having been up to 14 and rolled back to 12 where it happened.
Alternatively, if something is screwing up the passwords entered when I add a new one, can I activate the show+send password box in the modules without having access to the admin back end. In theory yes, but where???
Thanks
Thank you so much!
Thanks for posting this quick little tutorial. I was about to freak out when I realized I couldn't change my unknown password. This saved me a huge headache.
Can't login
Hi there. I am having trouble with my footprints filmworks administrator and the steps instructed seem not to be working for me. Any other ideas, please assist.
Md for footprints filmworks
Omar Abdulla
Email lost password
Hi Omar,
Did you try the "forgot password" link - to have your email password, or a password reset link - emailed to you? If the email address stored with the user is still active, you should be able to restore your password using this less intrusive method.
Lost username and pw
Hi there. I have lost my administration username and password for my domain. How do I go about resetting it and entering into my website domain.
Regards
Omar Abdulla from Footprints Filmworks
Back in Joomla
Awesome - thank you. Back inside my Joomla website now. I'll be sure to backup the password for next time! Thanks again for bailing me out
Worked great
Thanks very much for posting this. Saved me quite a bit of trouble!
Doesn't work in 1.5.10
I tried everything above. I changed the joomla.php file, no help. I ran the sql, no soap: UPDATE `#__users` SET `password` =MD5("getsmart") WHERE usertype = "Super Administrator";
I think Joomla sucks.
Try Drupal
Sorry you're having trouble with this. Why not give Drupal (drupal.org) a go? That is our CMS of choice
Awesome!
Thanks, it worked! You might want to be a bit clearer with the instructions. Initially I wondered if I was supposed to copy the text string into the "password" field for administrator because I (and probably many others) have no idea what an "MD5 function" is.
I entered the text string in the field under the "SQL" tab (using cPanel) and it worked!
Thank you.
U save me
I don't know how to thank you...your technique save my website from some [expletive]. Thanks very much!
How to reset Joomla 1.0 super admin account
I am using Joomla 1.0, and I lost my password. How do I reset it?
Jun
Resetting Joomla 1.0 password
We updated the article to include instructions for resetting passwords in earlier versions of Joomla. Please see the updated article above for details.
instructions easy to follow
It works for me. Thanks.
I do not know how to reset my password
I have downloaded the Hash Calc.and mysql. What is the stored connection, and default schema? Where do I find that info?
Janith
Use mySQL (via phpMyAdmin)
Hi Janith,
Try using mySQL's built in MD5 function as described above:
UPDATE example_users SET password=MD5('yourpassword') WHERE usertype = "Super Administrator";
Joomla Password Retrieval
Thanks a lot!!! It worked like a charm.
Does Joomla support secure password login?
Thanks for the tip. Now that I have my Joomla admin password back, is there any way to engage SSL when logging into Joomla? In other words, does Joomla support a secure login protocol? I ask because I'm planning on transferring some sensitive information from my old website to my new Joomla based site and my first priority is to ensure that the information stays secure and away from prying eyes.
Thanks,
Jenny
Reset Super Admin Password
Many Thanks!!! You just saved me a whole load of bother!
Martin
Joomla - got password back
Sweet! I just got my Joomla password back using the password recovery method you described. I suppose there's different ways of doing it, but the first approach you described did the trick. Thank you!
THANKS THANKS and THANKS!
THANKS THANKS and THANKS! From Romania
Script to reset your Joomla/Mambo password
Hello guys, in case you don't wanna have trouble accessing phpMyAdmin, there's a script which allows you to reset any Admin password EASILY. This works for Joomla 1.x and 1.5.
Lost PW change very easy
I just followed the instructions for update command in phpmyadmin and PW change was a snap - very easy. Thank you.
Thanks
Joomla rocks
How did this happen!?
I am freaked out that my password did not work in the first place. yes, I know, you think I mistyped or forgot, but NO, I was typing in the correct password. Well, using the SQL UPDATE statement worked like a charm for me, still freaked out.
The easiest thing to do!
You can use phpMyAdmin to view & edit the mos_users table?
insert
21232f297a57a5a743894a0e4a801fc3
in the password field of the admin user.
it's the md5 result of the standard password "admin".
This is really great
This is really great. Thank you so much.
Database error: can't access Joomla site
Please, for god's sake help me.
I don't really know what really happened. I was using myPhpAdmin. I went in the jos_users Database. Clicked SQL. And ran the following query, exactly like that:
UPDATE example_users SET password=MD5('admin') WHERE usertype = "Super Administrator";
Now my site just busted down completely !
When I try to access it, it says: Database Error: Unable to connect to the database:Could not connect to MySQL
Please give me a light !
Restore Joomla backup
Hi there,
First I would simply recommend loading a backup of your Joomla database. Also, I'm assuming you updated "example_users" to reflect your user name? If not, you may want to rerun the SQL statement with your user name inserted.
Thanks my friend
Thank you so much. Worked like a charm.
IT WORKS
Thanks for the UPDATE string, it works a teat.
James.
Joomla Password Reset Not Working
I get the message "Invalid session." Any help?
Clear cache and sessions
It sounds like you might need to clear your cache and your sessions tables. You can try doing it via your browser, if that doesn't work you might need to truncate the database tables.
still not working
I have tried all of this to no avail. I see my user name and MD5 password in phpMySQL. I've changed it, saved it, done everything. I go to login on my admin site and STILL get that my user name and password do not match! Any other trouble shooting tips??
Thanks Community
That was great to reset the password.
It's working, perfect.
Thanks
M. Javed Rahmani
Unable to login from the front end
Hi there, I did a site "clone" installed joomla in a test server, when everything was ready ...moved it to prod..a sister domain on the same server, everything is working fine, but cannot login to the "members" area...
I have no prob. on the admin side.....any ideas...
Password
This is great! Thanks a ton you just saved me a complete re-install. (blech!)
still wont login
Help! i've tried to change the password with MD5 encoding, but it still wont work.
the login page doesn't give any error message if i enter the right password, but it also wont login to the administrator page. it only take me back to the login page.
but if i entered the wrong password, it said "Username and password do not match"
anyone can help..?
i previously installed the same joomla 1.5RC but with different localhost/...... name and different db.
the old joomla cannot login, but the new joomla can...
Oh and the if ( true /* $crypt == $testcrypt */ ) wont work also
thx4 any help =)
cannot login backend and no errors
this is most likely because you session directory is not writable. you need to check with your host to make this directory 755
if you have root access you can putty into server and change permissions your self
which one is the session
which one is the session directory?
same problem
mine does the same thing. It gives you a need to login and not a bad username or password in the address bar.
index.php?mosmsg=You%20need%20to%20login
Any help?
Could be done much easier
Hi guy,
nice, but too complicated. MySQL and hence also phpmyadmin already offer the MD5 function. So you don't need a seperate website to create the MD5 hash.
Bests,
Daniel
Thanks Daniel
You're right - I've simply been to lazy to update the article until now. Thanks for the push!
If you have access to your
If you have access to your server, then it should be in configuration.php file.
Thank you so much !
Hello,
Just thought I'd take the time to thank you profusely !
You've just saved me hours of pulling my hair out...
This does suck a bit security-wise though, no ?
Thanks again,
Sincerely,
Marie (Avignon, France)
Simple UPDATE ... SET
Simple UPDATE ... SET password=MD5('yourpassword') doesn't work ?
MySQL has MD5 built in function.
lost username to Joomla
the site MD5er.com is inactive. i lost my username, not the password. the username is no longer admin. how do i proceed? why is it so challenging to get through this process. any other system has a simple "forgot username/password" button at the login stage...
MD5 Encryption
The solution: use Drupal instead
OR
We've updated the article with a mySQL UPDATE statement you can use to reset your password using mySQL's built-in MD5 function.
i changed the password and my site is down
HI!
I folowed these steps and now my site is completely down. I cant login or do anything. help!
Restore database
You may have inadvertently edited the wrong fields in the database. That, or your host is having issues unrelated to your changes. Does the site not load at all? Or you simply can't log in? Either way I recommend restoring a backup of your DB.
Thanks!
Worked perfectly - I'll have to remember this method for next time...
Great!
Helped me a lot.
Thanks.
ClickMedia.TV
A different approach ...
By temporarily removing the authentication in PHP, you can let anyone login. So, in Joomla 1.5 RC, you can go to plugins/authentication/joomla.php and modify the line:
if ( $crypt == $testcrypt) {
so that it reads:
if ( true /* $crypt == $testcrypt */ ) {
Now everyone can login with any password. Change your password to something that you can remember. Do not forget to put the original authentication code back in.
Jack
www.jackbriner.com
a different approach
Jack, YOU ARE THE MAAAAAANNNN!!! (maybe God?)... worked like a charm!..what a guy. thanks a lot for saving my bacon. bims
A different approach.......
OMG OMG OMG
after hours of searching and trying nothing worked
till I read Jacks one woot thanks heaps
HUG HUG HUG
............
Great solution!!
I was tearing my hair out! Was following the Joomla tutorial and couldn't get past the phpMyAdmin or MySQL Administrator passwords so I was well and truly stuffed here. Had all the files on Localhost because the site is not live yet so was able to easily find and edit the correct line. You saved my bacon!!
What a guy!
That worked a treat, much appreciated mate….
Saved me hours/days/weeks…..
Cheers
Thanks
Thank you Jack. That is a real help, you saved me a lot of stress!
Joomla Website
Thank you, the first approach didn't work for me.
If you want check out our joomla website - we're currently working on updating the site and since my developer is as slow as a snail I'm trying to learn how to develop my own site.
Thank YOU Very much!!
This was an invaluable piece of information and worked like a charm. Thanks for this!!!
Also with Joomla 1.0.15?
Hi Jack,
I have joomla 1.0.15 installed, and am unable to reset the password (MD5 from phpMyAdmin...).
I wanted to ask you if you know of a "different approach" which would also apply to my version of Joomla, as opposed to 1.5?
Thanks
Michael
Joomla 1.0.15 password recovery
I found a solution for 1.0.15
search in administrator/index.php and find the line (approx. 105)
if (strcmp( $hash, $cryptpass ) || !$acl->acl_check( 'administration', 'login', 'users', $my->usertype ) )
and change it to:
if ( false /* strcmp( $hash, $cryptpass ) || !$acl->acl_check( 'administration', 'login', 'users', $my->usertype )*/ )
now you can login and generate a new user or set your password in the backend.
all other versions of creating new passwd with or without salt didn't work in Joomla 1.0.15
Thnks a million!
Thank you for the useful info. I regained my access to the admin section now!!!
May I add that once you get to see your password in the _users , you should again use MD5er.com to decode it, because it is encoded there.
Cheers,
Nik
www.hotparishilton.net
password lost
I have lost my super adminsitrator password in joomla. no i cant looge to my super administrator
so ineed to get my super adminsitrator password. IS THERE ANYWAY I CAN GET MY PASSWORD BACK
Lost password reset
Unfortunately because the system stores the password in a one-way hash there is no way that I know of to get it back. This article does describe, however, how to reset the password (so you can regain access as Super Admin). Please let me know if you need help with or more detail on a particular step.
can`t reset my admin pass
I can not reset the admin password by following the steps. maybe i am doing something wrong? can you help please?
How to reset Joomla admin password
There's a software called password recovery. It can reset your Joomla or Drupal, etc. password in 3 easy steps.
 |
 |
 |
Our coveted 2011 Security Award goes to FrontPoint Security for their home alarm system (the review is hosted on our security site, ASecureLife.com).
Firefox wins our editor award as the market's most stable, secure, and supported browser.