How to Reset a WordPress Password with phpMyAdmin

If WordPress cannot send the password-reset email, you can restore access by changing the account password directly in phpMyAdmin. Back up the database first, confirm that you have selected the correct WordPress database, and change only the password field.

WordPress documents several password recovery methods. Try the Lost your password? link before editing the database. Use phpMyAdmin when email recovery is unavailable and you have legitimate access to the site's hosting account.

Back up the database

Editing the wrong row or table can affect site access. Export the database from phpMyAdmin before continuing:

1. Select the WordPress database.
2. Open the Export tab.
3. Choose the quick export method and SQL format.
4. Download the export file.

At minimum, export the users table that you are about to edit. A complete database backup provides a better rollback option.

Confirm the database and table prefix

A hosting account can contain several databases or WordPress installations. Check the site's wp-config.php file and find the database name in this line:

define( 'DB_NAME', 'database_name' );

In the same file, find the table prefix:

$table_prefix = 'wp_';

The default users table is wp_users, but many sites use a different prefix, such as site1_users. Do not assume that the table starts with wp_.

Change the password in phpMyAdmin

1. Open phpMyAdmin from your hosting control panel.
2. Select the database named in wp-config.php.
3. Open the table ending in _users.
4. Find the account by checking the user_login and user_email columns.
5. Click Edit for that row.
6. Locate the user_pass field.
7. Select MD5 from the function menu.
8. Enter a strong temporary password in the value field.
9. Save the row.

Do not edit user_login, ID, or other account fields during this recovery. Changing more than user_pass makes rollback and troubleshooting harder.

The MD5 value is temporary. After a successful login, WordPress replaces it with its current password hash. Do not manually paste an MD5 hash into the field when phpMyAdmin can apply the function for you.

Open the normal WordPress login page and sign in with the temporary password. Once access is restored, go to Users → Profile, set a new unique password, and click Log Out Everywhere Else under Sessions.

If you cannot find the administrator

The _users table stores accounts, but it does not clearly display their WordPress roles. If several accounts have similar names, avoid guessing.

With SSH and WP-CLI access, list administrators first:

wp user list --role=administrator

You can then reset the correct account using an interactive prompt:

wp user update admin_username --prompt=user_pass

Replace admin_username with the actual login name, then enter the new password when prompted. This avoids placing the password directly in the command, where it could be retained in shell history. The official wp user update documentation also supports selecting a user by ID or email address.

On WordPress Multisite, users are normally stored in the network's main users table. A table with a numbered site prefix is not necessarily the correct place to edit an account.

If the new password does not work

Check these points before changing the database again:

• Confirm that you edited the database used by the affected site.
• Verify the table prefix against wp-config.php.
• Make sure you edited the intended user row.
• Confirm that MD5 was selected when saving the temporary password.
• Try the account's user_login value instead of its display name or email address.
• Clear saved login credentials in the browser or use a private window.
• Temporarily disable security or authentication plugins if you can do so safely. Features such as two-factor authentication, external login services, or login restrictions can block access even when the database password was changed correctly.

If the row changed unexpectedly or the site developed a database error, restore the exported table or database and contact the hosting provider. A host can also confirm which database belongs to the site and help recover access without exposing database credentials.