The safest way to reset a MediaWiki administrator password depends on the access you still have. If the account has a working email address, use Special:UserLogin → Email new password. If you administer the server, use MediaWiki’s changePassword maintenance script instead of editing the database. On MediaWiki 1.40 and later, run maintenance scripts through maintenance/run.php. If the account is unusable or has lost its administrator groups, createAndPromote can create or repair a sysop account.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
Database changes are a last resort. Make a backup first, and do not expect a local password change to work when the wiki authenticates through LDAP, SSO, or another external provider.
As an Amazon Associate I earn from qualifying purchases.
Free tools Windows power users keep installed
One-click scans. No signup required.
Choose the recovery method that matches your access
Do not start by changing rows in the database. Work from the least invasive option that can solve the problem, and confirm which MediaWiki installation you are operating on before running any command.
| Method | Access required | What happens to the password | Administrator groups changed? | External authentication | Risk and reversibility |
|---|---|---|---|---|---|
| Email new password | Username and a working address on the account | MediaWiki emails a temporary password and instructions | No | Usually not applicable when the external provider owns the account | Lowest risk; no server change |
| Special:PasswordReset | An account with the editmyprivateinfo permission, plus a usable email destination |
MediaWiki sends an automatically generated password | No | May be ineffective if the external provider controls login | Low risk; route may be disabled |
changePassword maintenance script |
Shell or SSH access and the correct MediaWiki installation | Password is set directly on the named local account | No | Not authoritative when LDAP, SSO, or another provider handles authentication | Low database risk; command and credentials must be protected |
createAndPromote |
Shell or SSH access | Password is set while creating or modifying a user | Yes, when you specify groups such as --sysop |
May not help if local authentication is bypassed | Powerful; review the account and group changes carefully |
| Direct database edit | Database access and a verified backup | user.user_password is modified manually |
No | Can fail with non-default authentication providers | Highest risk; format and configuration errors can lock out users |
A logged-in administrator can use Special:ChangePassword, but that page is not a recovery mechanism for an account you cannot access. It changes the current password directly after authentication. Special:PasswordReset is different: it sends a generated password by email and can be disabled through $wgPasswordResetRoutes.
#1 Best Overall
- Requires 3 "AAA" batteries (included)
- Unit auto-locks for 30 minutes after 5 consecutive incorrect PINs
Reset the password by email
Use Special:UserLogin when the account email works
- Open Special:UserLogin on the wiki.
- Enter the administrator account’s exact username.
- Select Email new password.
- Check the mailbox associated with that account, including spam, quarantine, and any organizational mail filter.
- Follow the message instructions and sign in with the temporary password.
- Immediately set a new private password from the account’s password settings. Do not leave a password that was visible to another operator, copied into a ticket, or sent through an unencrypted channel.
This route does not restore deleted accounts, repair a damaged email address, or add administrator rights. It only helps when the named account exists, the address is usable, and the local wiki is responsible for authentication.
Understand Special:PasswordReset
Special:PasswordReset is intended for an authorized user who can trigger a reset for another account. The caller needs the editmyprivateinfo permission. MediaWiki generates a password and sends it to the target account’s email address rather than displaying a password in the browser.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →The route may not appear if the administrator has disabled it with $wgPasswordResetRoutes. A missing page therefore does not prove that the account or email is broken. Check the wiki configuration and the permissions of the account attempting the reset. If the account is managed by LDAP, SSO, or another external identity system, use that system’s recovery process instead of expecting MediaWiki’s email workflow to change the provider password.
When email does not arrive
- Verify the username, because a typo can target a different account or produce no useful result.
- Confirm that the account has an email address and that the address is marked usable in the wiki.
- Check spam, quarantine, forwarding rules, and the mail server’s logs.
- Check MediaWiki’s mail configuration and outbound transport from the server.
- Confirm that
$wgPasswordResetRouteshas not disabled the route. - If the account uses an external provider, stop trying local resets and follow that provider’s process.
Do not repeatedly request resets while troubleshooting. Multiple temporary passwords can arrive out of order, and the newest message may invalidate an earlier one.
Reset a local account from the server with changePassword
Check the installation and version first
You need command-line or SSH access, permission to run PHP for the wiki, and the installation directory that contains LocalSettings.php and the maintenance directory. Confirm that this is the production wiki you intend to change. A server can contain several MediaWiki installations with similarly named administrator accounts.
MediaWiki 1.40 and later normally invoke maintenance scripts indirectly through php maintenance/run.php. Older instructions may show direct execution of a script file. Use the convention that matches the installed release rather than copying an older command unchanged.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Rank #2
- Auto-Fill Feature: Say goodbye to the hassle of manually entering passwords! PasswordPocket automatically fills in your credentials with just a single click.
- Internet-Free Data Protection: Use Bluetooth as the communication medium with your device. Eliminating the need to access the internet and reducing the risk of unauthorized access.
- Military-Grade Encryption: Utilizes advanced encryption techniques to safeguard your sensitive information, providing you with enhanced privacy and security.
- Offline Account Management: Store up to 1,000 sets of account credentials in PasswordPocket.
- Support for Multiple Platforms: PasswordPocket works seamlessly across multiple platforms, including iOS and Android mobile phones and tablets.
Before changing anything, inspect the configured installation and database relationship. LocalSettings.php identifies the database and authentication configuration; changing the wrong directory can reset an account on a different wiki while leaving the intended site untouched.
Set a password with the current command
From the wiki installation directory, run:
php maintenance/run.php changePassword --user=Admin --password='Use-a-long-random-temporary-password'Replace Admin with the exact account name. Usernames are not interchangeable with display names, email addresses, or the database user ID. The command sets the local MediaWiki password directly; it does not send an email and it does not alter the account’s groups.
The password appears in the process command line and may be saved in shell history, terminal logs, audit tools, or monitoring output. Use a temporary value that is long and unique, then replace it through the web interface as soon as you have logged in. Restrict the terminal session to trusted operators.
Avoid exposing the password with passwordstdin
The maintenance script supports --passwordstdin. Supply the password through standard input instead of placing it in the command arguments:
printf '%sn' 'Use-a-long-random-temporary-password' | php maintenance/run.php changePassword --user=Admin --passwordstdinThe exact way you provide standard input depends on your shell and secret-management system. Avoid putting the secret in a script committed to source control, a shared chat transcript, or a process list. If your environment has a secret manager, have it feed the command’s standard input without writing the value to a persistent file.
Use a numeric user ID when names are uncertain
The script also supports --userid. This is useful when several names look alike or when you have verified the numeric ID from the wiki’s administrative tools or database. Do not guess the ID. A wrong ID can change a different account:
Rank #3
- NEVER FORGET A PASSWORD AGAIN: Almost every App. has a password, it is almost impossible to remember all the password log in details. This password book is specifically designed to help you create secure passwords and store all your passwords safely in one place. You will never forget your password log-in details again with this password keeper.
- ALPHABETICAL A-Z TABS FOR QUICK ACCESS: Alphabetical tabs design allows you to store your passwords alphabetically so you can find what you want faster, no more annoying searches!
- ANONYMOUS WITHOUT ANY TITLE: On the outside, this password notebook organizer looks just like those writing journals, there is no title listed on the cover, so no one would know it's a password book. But we still recommend keeping the internet password logbook in a safe place such as a locked drawer or a shelf full of books.
- THICK NO-BLEED PAPER: This 5.2" x 7.6" password book contains 74 sheets of thick 120gsm paper that resists ink smearing, say goodbye to those cheap password books that bleed ink!
- PREMIUM QUALITY & PERFECT MEDIUM SIZE: This password journal comes with a high-quality leatherette hardcover, an elastic band, pen holder, ribbon bookmarker, and inner accordion pocket. It measures 5.2 inches wide and 7.6 inches long, which is the perfect size for your needs.
php maintenance/run.php changePassword --userid=123 --passwordstdinUse either the verified username or the verified numeric ID for a single operation. After the command completes, test the login in a private browser window and verify that the account’s expected rights are still present.
Interpret common command failures
- File not found: You are not in the MediaWiki installation directory, or the release uses a different layout. Locate the directory containing
maintenance/run.phpand confirm the PHP path. - Unknown option: The installed release may be older than the documentation you are following. Run the script’s help output and use the options supported by that release.
- User not found: Check exact spelling, capitalization, namespaces, and whether you are connected to the intended wiki.
- Permission or database errors: Run as the account allowed to execute the wiki’s maintenance scripts, and verify that
LocalSettings.phppoints to a reachable database. - Login still fails: The account may authenticate through LDAP, SSO, or another provider, or the browser may be reusing an old session. Test in a private window and inspect the authentication configuration before changing more data.
Restore or create an administrator with createAndPromote
A password reset does not help if the account has lost its sysop group, if the original administrator account cannot be used, or if you need a controlled break-glass account. MediaWiki’s createAndPromote maintenance script can create a user or modify an existing user, set a password, and assign groups.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Create a new sysop and bureaucrat account
On MediaWiki 1.40 and later, run from the installation directory:
php maintenance/run.php createAndPromote Admin 'NEW_PASSWORD' --sysop --bureaucratThe first argument is the username and the second is the password. The flags request the sysop and bureaucrat groups. Grant only the groups required for recovery; bureaucrat rights are broader than ordinary administration and are not necessary for every task.
Modify an existing account with force
If the named account already exists, add --force when you intentionally want to change its password or grant the requested rights:
php maintenance/run.php createAndPromote Admin 'NEW_PASSWORD' --sysop --bureaucrat --forceReview the account name before using --force. This option is not a harmless retry: it authorizes modification of an existing identity. Use a temporary password, sign in, and rotate it immediately if more than one operator knew it.
Rank #4
- NEVER FORGET A PASSWORD AGAIN - Clever Fox password journal will help you create secure passwords and keep them safe and organized. This password book allows you to store all your passwords and other computer information in one place to find it easily.
- ALPHABETICAL A-Z TABS - Alphabetic tab system makes it easy to find any password you need. The book also has sections for most important passwords, wireless & email settings, software license information & additional notes.
- ELEGANT, SMART, PRACTICAL & SECURE PASSWORD ORGANIZATION - This password keeper book has been designed to be anonymous without an obvious title on the cover. For added security there is space to write hints instead of the password itself.
- POCKET SIZE & PREMIUM QUALITY - This internet address and password logbook with tabs comes in pocket size (4.0x5.5 inches). The password notebook has an eco-leahter hardcover, elastic band, pen loop, bookmark, pocket for notes, and thick 120gsm paper.
- 60-DAY MONEY-BACK GUARANTEE - We will exchange or refund your password organizer if you aren’t satisfied with your password organization for any reason. Reach out to us via message to refund your internet password logbook.
Other groups and local configuration
The script can also request groups such as --interface-admin and --bot, or custom groups where those groups exist in the wiki. Group names and available rights depend on the installed extensions and configuration. A flag that is valid on one wiki may be unavailable on another.
After signing in, open the user-rights or preferences pages and verify the result. Confirm that the account has the intended group, that no unrelated groups were granted, and that the account’s email and recovery details are current. Remove a temporary break-glass account when it is no longer needed, or document why it remains.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Use a database change only as a last resort
The official MediaWiki documentation describes direct modification of user.user_password only for situations where the normal web and maintenance-script paths are unavailable. This is not a general-purpose password recipe. The stored value must match the password format expected by the wiki, and the format depends on $wgPasswordDefault.
Protect the database before touching it
- Put the wiki in a controlled maintenance window or restrict public access while recovery is underway.
- Take a tested database backup, and record where it is stored.
- Confirm the database, table prefix, and user row belong to the intended MediaWiki installation.
- Confirm that the wiki uses MediaWiki’s default authentication provider rather than LDAP, SSO, or another extension.
- Record the existing value and the change time so the operation can be audited and reversed if necessary.
Do not paste a guessed hash or a value copied from an unrelated MediaWiki version. MediaWiki recognizes several historical formats and may convert a recognized older format after the next successful login, but an unrecognized or incorrectly formatted value can make the account unusable.
Recommended Free Tools
Why external authentication changes the answer
When an extension delegates authentication to LDAP, an SSO service, or another identity provider, the local user.user_password value may not be consulted at all. Editing it can create a false sense of recovery while the provider continues to reject the login. Recover the account in the provider, then verify that the MediaWiki account is mapped to the correct identity and still has its local groups.
Restore from backup if the edit goes wrong
If the wiki stops accepting logins or the database edit affects more than the intended row, stop making additional changes. Preserve logs, restore the verified backup according to your database procedure, and recheck the authentication configuration. A database administrator should handle restoration on a live wiki; do not improvise a second manual update to compensate for the first.
Best Value
- Securely Remember All Your Passwords, Log-in's, User Names, ATM PIN Numbers and More
- Large Back-lit LCD Screen, QWERTY Keyboard - So Easy to Use
- Enter one PIN number and have access to 400 accounts. Search function included.
- Unit auto locks for 30 minutes after 5 consecutive incorrect PIN attempts
- Includes mini stylus for easier keypad entry
Configuration and version checks that prevent lockouts
- MediaWiki release: For 1.40 and later, use
maintenance/run.php. Older releases may document direct maintenance-script execution. - Installation path: Run the command in the directory for the wiki whose account you intend to change.
- LocalSettings.php: Confirm database credentials, table prefix, and authentication extensions before any recovery action.
- Password-reset route: Check whether
$wgPasswordResetRoutesdisables the web reset page. - Authentication authority: Determine whether MediaWiki, LDAP, SSO, or another provider owns the password.
- Account state: Separate a forgotten password from a missing account, disabled account, or lost group membership; each requires a different remedy.
- Operational access: Ensure that the shell user can execute PHP and read the installation’s configuration without exposing secrets to other users.
Secure the wiki after access is restored
- Change the temporary password to a unique passphrase that is not used on any other service.
- Review recent account activity, user-rights changes, and server logs for unexpected access.
- Check the account’s email address and recovery settings, and remove obsolete addresses.
- Revoke or rotate any password that was placed in shell history, a ticket, a script, a command log, or a shared message.
- Remove temporary sysop or bureaucrat accounts and groups that were created solely for recovery.
- Confirm that backups are current and that at least one restoration has been tested.
- Document the verified recovery path, the MediaWiki version, and the authentication provider so the next incident does not begin with an unsafe database edit.
- Restrict public access again only after login, administrator rights, email delivery, and normal editing have been tested.
Troubleshooting by symptom
The email reset option is missing
Check whether you are on Special:UserLogin rather than the authenticated Special:ChangePassword page. Verify that the account has a usable email address and that the reset route has not been disabled through $wgPasswordResetRoutes. If the account is externally authenticated, use the external provider’s recovery flow.
The command changes a password but the user is still not an administrator
changePassword changes credentials only. It does not grant sysop, bureaucrat, or any other group. Verify the existing rights, then use createAndPromote with the required group flags and --force only when modifying an existing account is intentional.
The account can log in but cannot perform administrative actions
That is a group-membership problem, not a password problem. Inspect the account’s assigned groups and the relevant rights configuration. Create or promote a controlled recovery account if no existing bureaucrat can repair the membership.
The maintenance script reports success but the web login fails
First test in a private browser window and confirm the username. Then check whether the wiki uses an external authentication provider, whether the command ran against the correct installation, and whether a proxy or single-sign-on layer is sending the request elsewhere. Do not overwrite the database until those checks are complete.
A temporary password was exposed
Assume it is compromised. Log in, change it immediately, rotate any related credentials, and remove copies from scripts, history, tickets, and shared notes where your operational policy permits. If you cannot log in, run changePassword again with a new value through --passwordstdin.
Quick Recap
A practical recovery decision tree
- Can you receive mail for the administrator account? Use Special:UserLogin → Email new password, then replace the temporary password.
- Can an authorized logged-in user trigger a reset? Use Special:PasswordReset if the caller has
editmyprivateinfoand the route is enabled. - Do you have shell or SSH access? Use
php maintenance/run.php changePasswordfor a local account, preferably with--passwordstdin. - Is the account missing or missing administrator groups? Use
createAndPromoteand grant only the required groups. - Is the password controlled by LDAP, SSO, or another provider? Recover it there; local MediaWiki changes may have no effect.
- Is every safer route unavailable? Back up the database and treat a direct password-column edit as an emergency operation, with the format and configuration verified first.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minute
