Getting locked out of your own WordPress site is stressful, especially when the normal password reset email never arrives. Maybe your site stopped sending emails, maybe the admin email address is an old inbox you no longer control, or maybe you simply cannot get into that inbox at all. When the usual reset link is not an option, phpMyAdmin gives you a reliable way back in. It lets you change your password directly in the WordPress database, and the whole process takes only a few minutes if you follow the steps carefully.
This guide walks you through the full process: backing up first, finding the right database and user row, setting a new password correctly, and the important follow up step most guides skip, which is re-saving the password from inside WordPress so it is stored with modern hashing. Read the backup section before you touch anything, and do not skip the final step.
When Should You Reset a WordPress Password From phpMyAdmin?
Use the phpMyAdmin method only when the normal options have failed or are unavailable. Good reasons include a password reset email that never arrives, an admin email address you no longer control, a site that cannot send emails at all, or a hacked account where you need to regain control quickly. If you can still log in normally, just change your password from Users, then Profile inside the dashboard instead. That is faster and safer.
You will need access to your hosting control panel for this method, since phpMyAdmin lives there. If you do not have hosting access either, contact your hosting provider’s support team, since they can verify your identity and help you regain access. If you are new to the dashboard itself, our guide on the WordPress dashboard explained for beginners will help you find your way around once you are back inside.
Step 1: Back Up Your Database Before You Change Anything
Never edit a live database without a backup. A single wrong click in phpMyAdmin can break your site, and a backup is your undo button. Most hosting panels offer a one click database backup, or you can export a copy from inside phpMyAdmin itself before making changes.
- Log in to your hosting control panel, such as cPanel, Site Tools, or your host’s custom panel.
- Open phpMyAdmin from the Databases section.
- Select your WordPress database in the left sidebar, then click the Export tab at the top.
- Choose the Quick export method with SQL format, click Go, and save the downloaded file somewhere safe.
That exported SQL file is a complete copy of your database at this moment. If anything goes wrong, your host or a developer can restore it. If your host is unfamiliar territory, our web hosting guide explains how hosting panels and databases fit together.
Step 2: Open phpMyAdmin and Find the Right Database
Inside phpMyAdmin you will see a list of databases in the left sidebar. If your account hosts several sites, you may see several databases, and picking the wrong one is the most common mistake in this whole process. You need the database that belongs to the WordPress site you are locked out of.
If you are unsure which database is correct, check your site’s wp-config.php file in your hosting file manager. Near the top you will find a line defining DB_NAME, and the value in quotes is your database name. Match that name exactly in phpMyAdmin. Click the database name to expand its tables, and look for the users table. It is usually called wp_users, but the prefix may differ if your site was set up with a custom prefix. For example, it might be called wp5x_users or site_users. Whatever the prefix, the table ending in _users is the one you want.
Step 3: Edit Your User Row and Set a New Password
Click the users table, and you will see one row for every user account on the site. Find the row for your admin username by checking the user_login column. If you have several admin accounts, make sure you pick your own row, not someone else’s. Click the Edit link on that row.
On the edit screen you will see several fields. Find the user_pass field, which holds your password in hashed form. It will look like a long string of random characters, which is normal. WordPress never stores your actual password as readable text. Now do the following, in order.
- In the user_pass row, click the dropdown in the Function column and select MD5. This tells phpMyAdmin to convert your new password into the format WordPress understands.
- In the Value column for user_pass, delete the old hashed string completely and type a strong new password. Use at least 12 characters with a mix of upper and lower case letters, numbers, and symbols, and do not reuse a password from another site.
- Leave every other field exactly as it is. Do not change the username, email, or any other value on this screen unless you know exactly what you are doing.
- Click the Go button at the bottom to save the change.
If you prefer running a query instead of using the edit form, you can use the SQL tab in phpMyAdmin. Replace the table prefix, username, and password with your own values, and remember that this is only an example, not text to copy blindly.
UPDATE wp_users SET user_pass = MD5('YourNewStrongPassword123!') WHERE user_login = 'yourusername';After saving, go to your WordPress login page and sign in with your username and the new password. You should get straight into the dashboard. If login fails, do not keep guessing. Jump to the troubleshooting section below and check the common causes before changing anything else.
Step 4: Immediately Change the Password Again From Inside WordPress
This step is essential, and many tutorials skip it. The MD5 method works as an emergency key, but MD5 is an old and weak hashing method by modern standards. WordPress will accept it for login, but you should not leave your password stored that way. As soon as you are logged in, go to Users, then Profile in the dashboard, scroll to Account Management, and set a brand new strong password there. WordPress will store this one using its current secure hashing method.
Use a different password from the temporary one you typed in phpMyAdmin, and save it in a password manager. While you are in your profile, also check that the email address on the account is one you actually control, so future password reset emails reach you. This is also a good moment to review the basics in our guide on things to do after installing WordPress, which covers security settings that prevent lockouts like this one.
What If the Password Reset Does Not Work?
If you still cannot log in after the reset, work through these causes in order before trying anything drastic.
- Wrong database. If your hosting account has several WordPress installs, you may have edited the users table of a different site. Check DB_NAME in wp-config.php again and confirm you edited the matching database.
- Wrong user row. If two accounts have similar names, you may have changed the wrong one. Check the user_login and user_email columns carefully.
- MD5 function not selected. If you typed the new password as plain text without selecting MD5 in the Function column, WordPress cannot recognize it. Reopen the row, confirm the function, and save again.
- Caching or a security plugin. A caching plugin, firewall, or login limiting plugin can block repeated attempts or serve a stale login page. Clear your browser cache, try a private browser window, and temporarily rename the plugin folder via your file manager if you suspect a plugin is blocking you.
- Changed password from the wrong place. If you edited the password through a different tool that stored it differently, redo the change cleanly through phpMyAdmin following the steps above.
If you see a blank page instead of the login screen, that is a separate problem, and our guide on how to fix the WordPress white screen of death covers the likely causes.
What Are the Safer Alternatives to the phpMyAdmin Method?
phpMyAdmin is reliable, but it is not the only recovery method, and for some users another option is cleaner. If you have command line access, WP-CLI can reset a password with one command and stores it with proper hashing immediately, so no follow up re-save is needed. Many hosts also offer a WordPress password reset tool inside their control panel that handles the hashing for you, so check there first if your host provides one.
You may also find articles suggesting an emergency password reset script uploaded to your site. Treat that option with extreme caution. Such a script gives anyone who finds it full admin access, so if you ever use one, delete the file from your server the moment you have logged in, and never leave it sitting on a live site. For most users, the phpMyAdmin method in this guide, followed by the profile re-save, is the safest route that needs no extra tools. WordPress documents its own password recovery options at WordPress.org, and developer documentation lives at Developer.WordPress.org.
Frequently Asked Questions
Is it safe to reset a WordPress password from phpMyAdmin?
Yes, provided you back up first, edit only your own user row, and re-save the password from Users then Profile afterward so it is stored with current hashing. Never share database access with anyone you do not trust, since database access equals full control of the site.
Why must I select MD5 when setting the new password?
WordPress stores passwords as hashes, not readable text. Selecting MD5 tells the database to convert your typed password into a hash WordPress can verify at login. If you skip this, WordPress sees plain text where it expects a hash and login fails. The profile re-save afterward upgrades the storage to the modern method.
What if my users table is not called wp_users?
That is normal. The prefix is set during installation and can be anything, so your table might be named differently. Look for the table ending in _users in your site’s database, and confirm the database name in wp-config.php if you have several installs.
Can I reset another user’s password this way?
Technically yes, but you should only ever do this for your own account or for a user who has asked you to help them as the site owner. Changing someone else’s password without permission is a serious breach of trust, and on a client site it should only be done through proper admin channels.
Last updated: November 2026.
