How to Change a WordPress Admin Password
Change a WordPress admin password under Users, Profile, Account Management: click Set New Password, then Update Profile. Locked out? Use Lost your password? on wp-login.php. If that email never arrives, type the new password into user_pass in phpMyAdmin with the MD5 function; WordPress 6.8+ rehashes it to bcrypt at login.
For site owners locked out of wp-admin, or tidying access after a developer or staff member leaves.
knowledge
- Read time
- 4 min
- Sections
- 7
- Updated
- 14 Nov 2026
- Written by
- WebJi® team
Last editorial update: 14 November 2026.
Which method changes a WordPress admin password?
Use the dashboard if you can log in, the "Lost your password?" email if you cannot, and phpMyAdmin or WP-CLI only when that email never arrives. Pick the row that matches the access you still have, and stay on it.
| Access you still have | Method | Needs |
|---|---|---|
| You can open wp-admin | Users » Profile » Account Management | Nothing else |
| You cannot log in but can read the account's email | Lost your password? on wp-login.php | Working site mail |
| The reset email never arrives | phpMyAdmin: user_pass with MD5 | Hosting panel login |
| You have SSH and the wp command runs | wp user update | Shell access |
You are finished when a private browser window accepts the new password and rejects the old one.
How to change the WordPress admin password from the dashboard
Open Users, edit the administrator, click Set New Password under Account Management, and save with Update Profile or Update User. This replaces the password only; the username stays the same.
- Go to Users » Profile for your own account, or Users » All Users and click another administrator.
- Under Account Management, click Set New Password. WordPress fills in a strong generated password; keep it or type your own.
- Click Update Profile (your account) or Update User (someone else's).
- If the same section shows Sessions with a Log Out Everywhere Else button, click it to end the account's sessions in other browsers.
The strength meter is only a hint; the private-window test is the proof. On WordPress hosting this screen is inside WordPress, so the hosting panel is not involved.
How to reset a forgotten WordPress password from the login page
Click "Lost your password?" on wp-login.php, enter the username or email, and follow the link WordPress sends to the address stored on that user. This works only if the site can send mail and you can read that mailbox.
- Open yourdomain.com/wp-login.php, keeping any subfolder WordPress lives in.
- Click Lost your password?, enter the username or email, and click Get New Password.
- Open the email, follow the link, set the new password and save.
Reset links expire, so request a fresh one if it is old, but do not keep resubmitting the form: if nothing arrives, the problem is mail, not the password. If the new password is accepted and the dashboard still throws you back to the login screen, see WordPress login not working.
How to reset a WordPress admin password in phpMyAdmin
Edit the administrator's row in the users table, type the new password into user_pass, choose MD5 in the Function column, and click Go. WordPress 6.8 and later still accept an MD5 value and replace it with a bcrypt hash at the next successful login.
- Export the database first; the phpMyAdmin export guide takes a minute.
- Open wp-config.php in File Manager and note DB_NAME and $table_prefix. The users table is prefix + users, often wp_users but not always.
- In phpMyAdmin, open that database and the users table, and click Edit on the administrator's row.
- In user_pass, clear the value, type the new password in plain text, set Function to MD5, and click Go.
- Sign in at wp-login.php. The old password should now fail.
After that login, the stored value changes from a 32-character MD5 string to one starting $wp$2y$, WordPress's bcrypt format since version 6.8. If the old password still works, you edited a different user or a different site's database. Your hosting panel password is a separate login and is not affected.
How to change a WordPress password with WP-CLI
From the folder containing wp-config.php, find the admin's ID with wp user list, then set the password with wp user update. Use this only if your account already has SSH and the wp command runs.
wp user list --role=administrator --fields=ID,user_login,user_email
wp user update 3 --prompt=user_passThe --prompt=user_pass form asks for the password interactively, so it does not end up in your shell history the way --user_pass='…' does. Do not assume the admin's ID is 1; copy it from the list. A "Success: Updated user 3." line confirms the change.
Why the WordPress password-reset email never arrives
The reset email goes only to the user_email on that account, so an old address, a spam filter or a site that cannot send mail will all stop it. Requesting more messages fixes none of these.
- Wrong address: check user_email in the users table. An old developer's address means the link went to a mailbox you do not control.
- Spam: look in spam and promotions folders for a message from wordpress@yourdomain.
- Mail not sent: a security plugin or a missing SMTP setup can block it. An SMTP plugin with authentication usually fixes delivery; see what an SMTP server is.
Reset by phpMyAdmin, log in, and correct the email on the profile. The Administration Email Address under Settings » General is a separate field and is not changed by this. If phpMyAdmin is new to you on a WebJi® site, email support@webji.services, staffed 24/7 in Hindi and English with an average first reply under 60 minutes.
What to do after changing the WordPress admin password
Store the new password in a password manager, end other sessions, and check application passwords, because a password change does not revoke them. Application passwords are stored separately in the user's metadata and keep working for apps and integrations.
- On the profile, review Application Passwords and revoke any you do not recognise, especially after a suspected breach.
- Turn on two-factor authentication for every administrator.
- Remove administrator accounts nobody uses any more, rather than only changing their passwords.
Change the password when someone who knew it leaves or when you suspect a leak. The rest of the hardening list is in how to keep WordPress secure.
Frequently asked questions
Does the MD5 method still work after WordPress switched to bcrypt?
Yes. WordPress 6.8 changed password hashing to bcrypt, but the core team kept support for plain MD5 values so the phpMyAdmin method keeps working. The MD5 value is replaced with a bcrypt hash the first time you log in with it.
Can I change the admin username as well as the password?
Not from the profile screen; WordPress shows usernames as fixed. Create a new administrator with the username you want, log in as that user, then delete the old account and choose to attribute its posts to the new one when prompted.
What is the PASSWORD_HASH option in phpMyAdmin's Function list?
phpMyAdmin 5.1 and later can generate a bcrypt hash directly, which WordPress 6.8 and later also accept. MD5 is the safer choice when you are unsure of your phpMyAdmin or WordPress version, because every WordPress release still accepts it and rehashes it on login.
Will changing my password log out the mobile app or other integrations?
Integrations that use an application password keep working, because those credentials are stored separately from your login password. To cut them off, revoke the relevant application password on your profile screen.
Last editorial update: 14 November 2026.
Ready to get started with WebJi®?
Join 12,000+ businesses across India and overseas. INR pricing, 18% GST shown before payment and 24/7 email support in Hindi and English — average first reply under 60 minutes.