At 355 words, this article should take about 2 minutes to read.
I have lost count of the number of times I've forgotten the password to the local or development CMS.
My natural instinct is to click the Forgot Password link but, obviously, there's no way to trigger that email from the local system.
I've spent too long hunting through articles on how to recover the forgotten password. The quickest and easiest solution that I've found is to change the password manually in the database.
How do we do that then?
WordPress stores passwords in the
wp_users table. The prefix may be different if you have elected to change that in the
wp-config.php file. It's good practice to do that for security.
When you look at the table, it'll look a little like this…
WordPress stores your password as an MD5 hashed string. This prevents anyone with access to the database seeing confidential information in plain text.
WordPress salts the password using PHPass (as you can see from the
$P$ at the start of the example password). This hack will still work though as, even if your password has been salted, you can still replace the password with an MD5 hash, and WordPress will let you log in.
If this wasn't obfuscated like this, we'd be able to copy our password and paste it into the login form…but we can't - and for good reason!
So, to fix our little problem, we need to replace the existing hashed password with a new hashed password - we can't overwrite the MD5 hash with plain text because that won't work.
I would recommend that you don't create your "forever password" using these hash generators though. Overwrite the existing password with something easy to remember and very, very temporary - a favourite of mine is
Once the password has been changed, you can log in with your new password and immediately change it to something more secure.
I hope this helps you as much as it has helped me. 😎
Cover image courtesy of Clint Patterson.