> For the complete documentation index, see [llms.txt](https://docs.uxwizz.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.uxwizz.com/guides/resetting-admin-password.md).

# Resetting the admin password

If you know your current password, open **Settings → Users & domains** and select **Change password** for your account. UXWizz asks you to verify the change. An administrator can also change a lower-level user's password.

If you have forgotten the root administrator password and no authorized account can change it, recovery needs access to the **main UXWizz database**. Ask your server administrator to follow the procedure below.

{% hint style="warning" %}
These steps are for UXWizz 10.x. Back up the database first and confirm the installed version. Never enter a password into an online hashing tool. Password recovery does not remove two-factor authentication; keep your authenticator or recovery codes available.
{% endhint %}

## Steps to reset the password:

Generate a PHP password hash locally, update only the intended account, and revoke that account's existing sessions and API tokens. Current UXWizz stores password hashes, not reversible encrypted passwords.

### A. Using the MySQL console

1. On a trusted computer with PHP installed, open a Bash terminal. This command reads the new password without displaying it or putting it into command history. For this recovery command, use 12–72 printable ASCII characters:

   ```bash
   IFS= read -r -s -p 'New password: ' UXWIZZ_NEW_PASSWORD
   printf '\n'
   printf '%s' "$UXWIZZ_NEW_PASSWORD" | php -r '$p = stream_get_contents(STDIN); if (!preg_match("/^[\x20-\x7E]{12,72}$/D", $p)) { fwrite(STDERR, "Use 12-72 printable ASCII characters.\n"); exit(1); } echo password_hash($p, PASSWORD_DEFAULT), PHP_EOL;'
   unset UXWIZZ_NEW_PASSWORD
   ```

   Copy the complete resulting hash, including its `$` characters. Treat it as sensitive. You can choose a longer passphrase through UXWizz after recovery.
2. Connect to the main UXWizz database using your host's database tool or an authenticated MySQL/MariaDB console. Use a password prompt or a protected client configuration; do not put a database password in a command argument.
3. Identify the intended account. Do not assume that its ID is `1`:

   ```sql
   SELECT id, name, level FROM ust_users WHERE name = 'admin';
   ```

   If you renamed the account, use that exact username. Confirm that the query returns the account you own.
4. Replace `PASTE_PHP_PASSWORD_HASH_HERE` below with the complete hash. Use the same confirmed username. Run the transaction in one database connection:

   ```sql
   START TRANSACTION;
   SET @recovery_user_id = (SELECT id FROM ust_users WHERE name = 'admin');

   UPDATE ust_users
   SET password = 'PASTE_PHP_PASSWORD_HASH_HERE', salt = ''
   WHERE id = @recovery_user_id;
   SELECT ROW_COUNT() AS passwords_updated;

   UPDATE ust_auth_sessions
   SET revoked_at = UTC_TIMESTAMP(), revoke_reason = 'password_recovery'
   WHERE user_id = @recovery_user_id AND revoked_at IS NULL;

   UPDATE ust_api_tokens
   SET revoked_at = UTC_TIMESTAMP()
   WHERE user_id = @recovery_user_id AND revoked_at IS NULL;
   ```
5. Confirm that `passwords_updated` is **1** and that all statements succeeded. Then save the transaction:

   ```sql
   COMMIT;
   ```

   If the account is wrong, a statement fails, or the count is not 1, run `ROLLBACK;` in the same connection instead and resolve the problem before trying again.
6. Sign in over HTTPS with the new password and complete 2FA if enabled. Existing sessions and API tokens for that account are revoked. Recreate only the API tokens that you still need.

### B. Using PHPMyAdmin:

Select the main UXWizz database and use its **SQL** tab to identify the account. Generate the hash locally as described above.

For the reset itself, use the MySQL/MariaDB console procedure above or ask your database administrator to perform the same transaction. Separate phpMyAdmin submissions may use different connections, so do not split a transaction across its SQL forms. Editing only the password cell does not revoke existing sessions and API tokens.

#### Example:

For an account named `admin`, the lookup must return that account's row. The replacement value is the complete PHP hash, such as one beginning with `$2y$`, and `salt` becomes an empty string. Do not reuse the old SHA-256 method or copy another user's hash.

If you cannot access the database, contact your server administrator or [UXWizz support](/guides/support.md). Do not reinstall UXWizz, delete the database, or replace `UXWIZZ_APP_KEY` to recover a password.

## Legacy recovery for UXWizz 8.5.0

This version used SHA-256 of the account's salt followed by its password. The original database/phpMyAdmin repair is still applicable to that schema. Do not use it to replace modern password hashes in UXWizz 10.

1. Back up the main database. Find your account in `ust_users`, verify its `name` and `id`, and copy its `salt` exactly. Keep that salt unchanged.
2. On a trusted computer with PHP, open Bash and generate the legacy hash locally. Replace `PASTE_ACCOUNT_SALT_HERE` with that account's salt:

   ```bash
   IFS= read -r -s -p 'New password: ' UXWIZZ_NEW_PASSWORD
   printf '\n'
   printf '%s' "$UXWIZZ_NEW_PASSWORD" | php -r 'echo hash("sha256", "PASTE_ACCOUNT_SALT_HERE" . stream_get_contents(STDIN)), PHP_EOL;'
   unset UXWIZZ_NEW_PASSWORD
   ```
3. In phpMyAdmin, edit **only the intended account's** `password` cell and paste the resulting 64-character lowercase hash. Leave its `salt` unchanged. Alternatively, use the SQL console with the confirmed username:

   ```sql
   UPDATE ust_users
   SET password = 'PASTE_64_CHARACTER_LEGACY_HASH_HERE'
   WHERE name = 'admin';
   ```
4. Confirm exactly one row changed, then sign in with the new password. Do not send the password to an online hash tool.

This legacy method restores a password; it does not provide the session/API-token revocation used by the current recovery procedure. If the account may have been compromised, have your administrator address existing access and plan an update separately.