Reset a WordPress Password in the Database as a Last Resort

Direct database password recovery is a last resort for an authorized WordPress owner or administrator. Prefer the normal reset link or an authorized WordPress/WP-CLI operation. A database edit can target the wrong site or user and does not repair a compromised installation.

Identify the correct database and account

Keep an appropriate protected database backup and a recovery plan. Confirm the actual database and table prefix from the installation’s configuration without exposing its database credentials. Do not assume the database name begins with wp, that the users table uses the default prefix, or that the administrator has ID 1. In multisite, identify the shared user table and intended site context deliberately.

phpMyAdmin recovery

1. Open the trusted database-management interface through your hosting account. This requires suitable access; phpMyAdmin does not make the operation risk-free.
2. Select the confirmed database and actual users table. Locate the exact account using its ID/login and inspect the selected row before editing.
3. For the legacy-compatible recovery method documented by WordPress, edit only user_pass, select the MD5 function and enter a unique temporary recovery password. Do not enter plaintext without the required function, and do not change every user row.
4. Save the one intended row. Test WordPress login privately and complete any applicable account recovery checks.

WordPress documents this as a compatibility route: its normal login can replace the temporary MD5 value with a stronger hash. MD5 is not the recommended ongoing password-storage scheme. Authentication plugins or an external identity provider can change the behavior, so do not assume the core workflow applies to every installation.

After access is restored

Use WordPress account settings to set a strong unique password and review active sessions/application passwords as appropriate. If the account email was changed maliciously, investigate that incident instead of assuming a password reset removes the attacker.

Do not submit passwords or database dumps to public hash generators or ordinary support messages. The old inline-password SQL examples and generic root database login shortcut have been withdrawn; they exposed secrets and made wrong-scope edits too easy.

References: WordPress’s documented database recovery limits; current WordPress password hashing.

Reviewed October 15, 2026. No customer database row or login was modified; plugin-specific recovery was not tested.