I have lost count of the number of times I've forgotten the password to the local or development CMS.
My natural instinct is to click the Forgot Password link but, obviously, there's no way to trigger that email from the local system.
I've spent too long hunting through articles on how to recover the forgotten password. The quickest and easiest solution that I've found is to change the password manually in the database.
How do we do that then?
WordPress stores passwords in the wp_users table. The prefix may be different if you have elected to change that in the wp-config.php file. It's good practice to do that for security.
When you look at the table, it'll look a little like this…
| ID | user_login | user_pass |
|---|---|---|
| 1 | thomasxbanks | $P$BHpcLw/aWsTPmeDprzXwOEl45bJm9A3 |
WordPress stores your password as an MD5 hashed string*. This prevents anyone with access to the database seeing confidential information in plain text.
If this wasn't obfuscated like this, we'd be able to copy our password and paste it into the login form…but we can't - and for good reason!
So, to fix our little problem, we need to replace the existing hashed password with a new hashed password - we can't overwrite the MD5 hash with plain text because that won't work.
I have Hasher installed as a plugin in VS Code. If you don't use VS Code or don't want to use this extension, MD5 Hash Generator Online works pretty well.
I would recommend that you don't create your "forever password" using these hash generators though. Overwrite the existing password with something easy to remember and very, very temporary - a favourite of mine is Pa55word! —
267057150e34eca5c6af39ec9b30864e
Once the password has been changed, you can log in with your new password and immediately change it to something more secure.
I hope this helps you as much as it has helped me. 😎
* As pointed out by @sorinmarta in the comments, WordPress salts the password using PHPass (as you can see from the $P$ at the start of the example password). This hack will still work though as, even if your password has been salted, you can still replace the password with an MD5 hash, and WordPress will let you log in.
Top comments (2)
Awesome article! I'm sure that's going to help a lot of people.
But WordPress doesn't use MD5 since MD5 is easy to crack. WordPress is using Portable PHP password hashing framework. Here you have more details about that:
openwall.com/phpass/
Other than that the article is great and the information will probably help a lot of developers that are just beginning. Thanks for writing it!
Thanks Sorin! I've updated the article to reflect your comment 😁