If you are signed in, change the password from Users > All Users: open the account, scroll to New Password, choose Generate Password or enter your own, then select Update User. The new password works immediately. If you cannot sign in, use Lost your password? on the login screen first; WP-CLI, the database, or a temporary file-based reset are fallback options when email recovery is unavailable.
Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.
Choose the safest method you still have access to
Use the least invasive route that matches your access. Dashboard and email recovery are designed for routine use. Server and database methods can recover an administrator account, but a wrong user, table, or command can lock out the wrong person or damage the site.
As an Amazon Associate I earn from qualifying purchases.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware match| Access you still have | Recommended path | Important limitation or risk |
|---|---|---|
| WordPress dashboard | Users > All Users, edit the user, set New Password, and select Update User | Lowest operational risk; the change takes effect immediately. |
| Account email and the login page | Lost your password? and the emailed reset link | Requires access to the mailbox and a site that can send WordPress mail. |
| Server shell and WP-CLI | wp user update with --prompt=user_pass, or wp user reset-password |
Best technical option, but protect terminal output, history, logs, and support sessions. |
| Database access | phpMyAdmin or MySQL, after making a backup | Higher risk; you must select the correct database, table prefix, and account. |
| File or FTP access only | A temporary wp_set_password() call or an emergency reset script |
Remove the code or script immediately after recovery. |
Before you begin
Identify exactly which account needs a new credential. The login name (user_login) and the display name are not necessarily the same, and a site may contain several administrators with similar names. If another administrator is performing the change, agree on the account and how the new credential will be delivered before saving it.
Prefer the dashboard or the login-page link whenever possible. If you must use WP-CLI, database access, or files, confirm that you are working on the production installation rather than a staging or neighboring site. For database and file methods, make a backup first and keep the backup available until a new login has been verified. Have a password manager ready so a generated value is not left in a browser field, text file, ticket, or chat transcript.
#1 Best Overall
Change a password from the WordPress dashboard
This is the normal procedure when you can sign in to an administrator or other account with permission to edit the target user.
- Sign in to the WordPress administration screen.
- Open Users > All Users.
- Select the username whose password should change. If you are changing your own password, open your own account; an administrator can open another user.
- Scroll to the New Password section.
- Select Generate Password to let WordPress create a value, or replace the generated value with a unique password you choose.
- Select Update User.
WordPress activates the new password immediately. Any new login must use the replacement password, not the old one. If you generated a password, copy it into a password manager before leaving the page; do not paste it into an unsecured note or send it through an ordinary chat message.
Changing another user’s password
An administrator can open the intended account from Users > All Users and use the same New Password controls. Confirm the username before saving, particularly on a site with several similarly named accounts. Changing the wrong user can interrupt another person’s access and is difficult to diagnose if you do not record which account you edited.
What to do when the generated value is rejected
Keep the generated value or enter a longer unique one rather than reusing a password from another service. If a security plugin imposes additional rules, follow the requirement shown beside the password field. Select Update User again only after confirming that the account name at the top of the page is the one you intended to change.
What happens after you save
The replacement is active as soon as Update User succeeds. Record the time and account changed if you administer a team site, and tell the account holder through a secure channel. Do not include the password in that notification; provide instructions for retrieving it from the password manager or have the user set a new value after signing in.
Reset a forgotten password from the login page
Use email recovery when you are locked out but still control the address attached to the account.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
- Open the site’s login page. On many installations, this is
/wp-login.phpafter the site’s domain. - Select Lost your password?.
- Enter the account’s username or email address.
- Submit the form and open the reset message delivered to that mailbox.
- Follow the link in the message and set a new password.
- Return to the login page and sign in with the replacement password.
The link is tied to the account and is intended for the recipient of that mailbox. Do not forward it. If WordPress supplies a temporary value during the process, sign in with it and set a memorable, unique replacement from the profile page.
If you do not know the username
Try the email address associated with the account in the recovery form. If several accounts share access to the same mailbox, check the name shown in the reset message before continuing. Do not keep submitting guesses indefinitely; confirm the correct account with the site owner or administrator.
If you no longer control the mailbox
Email recovery cannot help until access to the account mailbox is restored or an administrator uses another documented path. Do not send a reset link to a substitute address by editing a random database row. Use a verified administrator, WP-CLI, or hosting support with proof that you control the site.
Reset a WordPress password with WP-CLI
WP-CLI is the preferred technical route when you have shell access to the WordPress installation. The WordPress Developer Handbook describes it as a command-line method that avoids directly modifying database tables.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Set a password you choose without putting it in shell history
Run the command from the WordPress installation directory, replacing USERNAME with the account login:
wp user update USERNAME --prompt=user_passWP-CLI prompts for the password instead of placing the secret in the command itself. This avoids one common source of exposure: shell history. The account login must identify the intended user, so verify it before confirming the prompt.
Generate a replacement password
wp user reset-password USERNAMEwp user reset-password can reset one or more users and can send a change notification. The exact output depends on the options you select and your WP-CLI environment.
--show-passworddisplays the generated secret. Use it only when necessary; terminal output, captured logs, screenshots, screen-sharing sessions, or support tickets can expose the value.--skip-emailsuppresses the notification. Use this only when you have a clear operational reason and another secure way to tell the user that the password changed.--porcelainoutputs only the password. That can help automation, but it also makes it easy for scripts or logs to capture the secret.
After the command succeeds, test a login in a fresh private browser window. Close or clear any terminal recording that contains the password, and remove it from shell history where your operating system or shell records commands.
WP-CLI checks before you run a reset
- Run the command in the correct WordPress installation, not a staging or neighboring site.
- Confirm the login name exactly, including capitalization and punctuation as displayed by your user-management process.
- Ensure the shell account has permission to read the WordPress files and load the installation.
- Decide in advance whether the account holder should receive a notification.
- Keep generated output out of shared terminal recordings, CI logs, and support transcripts.
If you need to reset several users, verify each login before running the command. A bulk reset is powerful, but it increases the impact of a typo and makes it harder to identify which account needs follow-up.
Use phpMyAdmin or MySQL only as a controlled fallback
Direct database editing is appropriate only when you understand the site’s database and have a current backup. WordPress stores passwords as hashes. Entering a plain-text password directly into user_pass does not create a usable WordPress password.
- Create and verify a backup before editing anything.
- Select the database used by this WordPress installation.
- Read the table prefix from
wp-config.php. The users table may not be namedwp_users; a custom prefix is common. - Open the users table and locate the account by its
user_login, not by a guess based on display name. - Edit the
user_passfield using the password-hashing function and procedure documented by WordPress. Do not paste an un-hashed value. - Save the row, close the database tool, and test the login.
If phpMyAdmin does not show a table named wp_users, first check that you selected the correct database and then verify the prefix in wp-config.php. If the account still cannot authenticate after a database edit, stop making changes and restore the backup or use WP-CLI with the correct installation.
Why database mistakes are especially serious
A wrong table prefix can lead you to an unrelated table. A wrong row can change another user’s access. An invalid hash can make the account unusable while appearing to have saved successfully. These are the reasons the official guidance favors WP-CLI over direct table modification when shell access is available.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Recover with FTP or a temporary reset script
When the dashboard, email, WP-CLI, and database routes are unavailable, WordPress documents two file-access approaches: a temporary wp_set_password() call in the active theme’s functions.php, and an emergency password-reset script.
Temporary functions.php call
With a secure file or FTP connection, add the documented wp_set_password() call to the active theme’s functions.php, targeting the intended user. The call must identify the correct user and must be removed immediately after you successfully sign in. Leaving it in place can reset the password again whenever WordPress loads the theme, potentially locking you out and exposing a dangerous access path.
Emergency reset script
Use the emergency script only when the other documented methods fail and you can protect the file from public access while it exists. Follow the official script’s targeting and placement instructions exactly. As soon as the password changes, delete emergency.php from the server. Do not merely rename it or leave it for later cleanup: an accessible reset script can become a public password-reset mechanism.
File-access safety checklist
- Back up the original file before editing it.
- Target one known account and confirm its user ID or login.
- Use a secure connection and avoid sending the temporary password in an unencrypted message.
- Test the new login in a separate browser session.
- Remove the temporary function or delete the emergency script immediately.
- Clear copies of the temporary secret from local notes, ticket systems, and shared screenshots.
Troubleshoot common reset failures
The reset email never arrives
- Confirm that you entered the account’s actual username or email address.
- Check spam, junk, quarantine, and any mailbox rule that might move automated messages.
- Ask the hosting provider or mail administrator whether the site is permitted to send mail.
- Verify the site’s mail configuration if you administer the server.
- If you have shell access, use the WP-CLI method instead of repeatedly requesting new messages.
Do not assume that requesting another link fixes delivery. If the site cannot send mail, a new request produces the same failure until mail delivery is corrected or another recovery path is used.
The reset link is expired or invalid
Request one new link and use the newest message, rather than an older link saved in a browser tab. Open it in the same mailbox account that received it, and avoid forwarding or modifying the URL. If a fresh link also fails, use an administrator, WP-CLI, or another controlled recovery method.
You changed the wrong account
Stop before making additional edits. Confirm the intended login and user ID, tell the affected account holder if appropriate, and restore from a backup if the mistake involved a direct database change. Repeat the process only after identifying the correct row or dashboard account.
You cannot find the users table
Check the selected database and read the configured table prefix in wp-config.php. A site using a custom prefix will not necessarily have a table literally named wp_users.
You used an emergency file
Delete the emergency script immediately after the password change. If you used a temporary theme function, remove that call as well, then inspect the file to ensure no reset code remains.
Recommended Free Tools
The new password still does not work
Confirm that you are logging into the same site and account you changed. Check for a copied password with an extra space, and test in a private browser window to avoid an old saved value. If the change came from the database, verify that the documented hashing procedure was used; plain text in user_pass is not a valid WordPress credential.
Secure the account after changing the password
- Use a unique password that is not used on another service.
- Store it in a reputable password manager rather than an unprotected text file.
- Protect the mailbox linked to the account, because mailbox access can usually trigger another reset.
- Protect the hosting account and server credentials that can reach WP-CLI, the database, or WordPress files.
- Review who has administrator access and remove accounts that no longer need it.
- Sign out of old browser sessions and shared computers, then sign in again with the new password.
- Delete temporary scripts, remove temporary code, and clean exposed terminal output.
A password change fixes the credential; it does not repair a compromised mailbox, hosting account, or server. If an attacker may have accessed any of those, secure them separately and review the site for unauthorized users or files.
Which method should you use?
| Your situation | First choice | Use a fallback when |
|---|---|---|
| You are signed in | Dashboard profile or user edit screen | Only if the dashboard is unavailable. |
| You are locked out but receive account mail | Lost your password? | Mail delivery fails or you lose mailbox access. |
| You administer the server | WP-CLI with --prompt=user_pass |
The installation cannot be loaded from the shell. |
| You have only database access | Backup, identify the real prefix and user, then use the documented hashing method | Use hosting support or file access if you cannot verify the hash procedure. |
| You have only FTP or file access | Temporary documented reset code | Delete every temporary mechanism immediately after recovery. |
Final verification checklist
- Confirm the username or user ID you intended to change.
- Sign in with the new password in a private browser window.
- Confirm that the old password no longer works if your security policy requires that check.
- Verify that the account’s email address is still correct.
- Remove emergency code, scripts, exposed command output, and temporary notes.
- Secure the mailbox and hosting credentials that could reset the account again.
Frequently Asked Questions
How do I change my WordPress password while logged in?
Go to Users > All Users, open your account, scroll to New Password, choose Generate Password or enter a unique value, and click Update User. The new password becomes active immediately.
I forgot my WordPress password. What should I try first?
Open the login page, select Lost your password?, enter the account username or email address, and follow the emailed reset link. This is the simplest route when you control the mailbox and the site can send mail.
Free tools Windows power users keep installed
One-click scans. No signup required.
Can I reset a WordPress password with WP-CLI?
Yes. Use wp user update USERNAME --prompt=user_pass to enter a chosen password without putting it in shell history, or use wp user reset-password USERNAME to generate a replacement. Protect output, logs, and recordings from exposing the secret.
How do I change a WordPress password in phpMyAdmin?
Use phpMyAdmin only with a verified backup. Select the correct database, read the actual table prefix from wp-config.php, locate the row by user_login, and apply WordPress’s documented hashing procedure to user_pass. Plain text will not work.
What if the WordPress reset email never arrives?
Check the username or email, spam and quarantine folders, mailbox rules, and the site’s mail configuration. Ask the host or mail administrator about delivery. If you have shell access, use WP-CLI instead of repeatedly requesting links.
What should I do after using an emergency reset script?
Delete emergency.php immediately after the password changes. If you added a temporary wp_set_password() call to functions.php, remove it as well and verify that no reset code remains.
Can an administrator change another user’s password?
Yes. An administrator can open the intended account under Users > All Users and use the New Password controls. Confirm the username before saving so another person’s account is not changed accidentally.
Why does a database password change appear to save but not let me log in?
The value may have been entered as plain text or with the wrong hashing procedure. WordPress stores hashed passwords. Stop editing, restore the backup if needed, and use WP-CLI or the documented hashing method on the correct user row.
The Bottom Line
Use Users > All Users and Update User when you can sign in. If locked out, try Lost your password? first. Use WP-CLI when shell access is available, and treat database, FTP, and emergency-script methods as higher-risk fallbacks. Verify the account, protect every temporary secret, and remove temporary code or files immediately after recovery.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitches
