If You Can't Log Into wp-admin: Diagnose the Situation Correctly First

There are several common reasons for being unable to log into the WordPress admin panel: forgetting the password, the 'lost your password' link never arriving because the email/SMTP configuration is broken, losing the two-factor authentication (2FA) device, or a security plugin locking the account. Email problems in particular are common: in many shared hosting environments, mail sent from the server lands in the spam folder or is never delivered at all because SMTP is not configured properly, and in that case waiting for the 'lost your password' link is nothing but a waste of time. What these situations have in common is this: you cannot log into the admin panel, but you usually do have access from your hosting account's control panel to a database management tool such as phpMyAdmin or Adminer, or to WP-CLI over SSH. If you have that access, it is possible to reset the password directly from the database without waiting for WordPress's own email-based recovery flow.

Why This Method Works: phpass and Backward Compatibility

The WordPress core normally stores user passwords with phpass; this is a salted, multi-round hashing algorithm and is not practical to compute by hand. However, WordPress's password verification function wp_check_password() also recognises the case where the stored value is a plain MD5 digest, for backward compatibility. If you write an MD5 hash directly into the user_pass field in the database and that hash matches the password you enter, the login succeeds — and, what is more, WordPress automatically re-hashes the password into the modern phpass format after that login. This behaviour is an official part of the WordPress core and a well-known, legitimate recovery method for site administrators who have phpMyAdmin or SQL access but cannot get into the admin panel.

The reason for this backward compatibility is historical: older versions of WordPress stored passwords as plain MD5, and phpass was added later. So that accounts left over from that era would not be locked out overnight, the core team built logic into wp_check_password() that recognises both the phpass and the MD5 format. This recovery method works precisely because of that backward compatibility logic.

The SQL Command and an Example

The general format of the command is as follows:

For example, if the table prefix is wp_ and the username is admin:

In the hash part you need to write the MD5 digest of your new password — the hash, not the plain text password. Pasting this command into phpMyAdmin's SQL tab and running it is all it takes.

Step by Step in phpMyAdmin

  • Open phpMyAdmin from your hosting control panel and select the database your WordPress site uses.
  • Find the {tableprefix}users table in the left menu; confirm the prefix from the $table_prefix variable in the wp-config.php file.
  • Find the relevant user's row and edit the user_pass field, or run the UPDATE command above straight from the SQL tab.
  • If phpMyAdmin's row editing interface has a 'Function' column, you can select the MD5 option and enter your new password as plain text; if you are running it from the SQL tab, you need to compute the hash in advance and paste the value as it is.
  • After running the query, go to the wp-admin login screen and try to sign in with your new password.

Alternative: Running It over SSH with WP-CLI

As well as phpMyAdmin, if you have SSH access to your server and WP-CLI installed, you can run the same query from the terminal. WP-CLI's wp db query command reads the database connection details automatically from the wp-config.php file in the site root and lets you run the query directly:

The advantage of this method is that it removes the need to check the table prefix by hand; WP-CLI is already connected to the right database with the right credentials. If you use a lightweight database management interface such as Adminer, pasting the same UPDATE query into its SQL command screen and running it is equally sufficient; the steps are the same as with phpMyAdmin.

A Note on Ownership and Ethics

What to Do Afterwards

Running the SQL command and logging in with the new password is not the end of the job. WordPress automatically re-hashes the password into the modern phpass format on an MD5 match, but that is only triggered after a successful login. This re-hashing usually already happens at the moment you log in; even so, as an extra safeguard it is recommended that you change your password once more from the normal Profile screen after logging in. That step lets you be certain your account is definitely stored in the modern, salted hash format.

Common Mistakes

  • Assuming the table prefix is the default wp_ and using it without checking — in many installations a different prefix (the $table_prefix in wp-config.php) is defined for security reasons, and if the command writes to the wrong table it has no effect at all.
  • Writing the wrong username in the WHERE user_login = '...' part; the login name and the display name shown on screen are usually different.
  • Copying quotation marks or the hash value incompletely or incorrectly in hand-written SQL; a single missing character either makes the query fail or results in the wrong hash being written.
  • Accidentally writing the plain text password into the password field instead of the MD5 hash; the login then fails, because wp_check_password() interprets the stored value as a hash.

Using a tool that computes the hash inside the browser, rather than working it out by hand, both guarantees the correct syntax and means your password never has to be transmitted to any server — the query simply becomes ready to copy to your clipboard.