Locked out of the Joomla administrator: getting back in through the database

The previous developer left, nobody wrote down the Super User password, and the reset mail never arrives. Or you changed phones and the authenticator app with your second login step went with the old one. Either way the administrator login says no, and the site keeps running without you.

You do not need the old password to get back in. You need access to the database, through phpMyAdmin, Adminer or the command line at your host. Everything below works on Joomla 4, 5 and 6.

First: try the normal reset

Open https://example.com/index.php?option=com_users&view=reset on the front end, enter the e-mail address of the account and follow the link in the mail. If that works, you are done in two minutes. If no mail arrives, check the spam folder, then check Mail settings later, because a site that cannot send a reset mail also cannot send contact form mail. Then continue with the database.

Find the table prefix

Joomla tables do not start with jos_ any more. Open configuration.php in the site root and look for:

public $dbprefix = 'x7k2p_';

In the examples below, replace x7k2p_ with your own prefix. The same file has the database name, user and password if your host does not give you a direct phpMyAdmin link.

Set a new password

Find the account first:

SELECT id, username, email, block, requireReset
FROM x7k2p_users
ORDER BY id;

Joomla stores passwords as bcrypt or Argon2 hashes, so you cannot type a plain password into the password column. Generate a bcrypt hash on any machine with PHP:

php -r "echo password_hash('Temp-2026-change-me', PASSWORD_BCRYPT), PHP_EOL;"

and put the result in the column:

UPDATE x7k2p_users
SET password = '$2y$10$...the hash you just made...'
WHERE id = 42;

Older guides tell you to use MD5('newpassword'). Joomla used to accept MD5 hashes and convert them at the next login, but that fallback is legacy code and you should not count on it in current versions. A bcrypt hash always works.

Check that the account is not blocked

A correct password still fails when the account itself is switched off. In the same row, check:

• block must be 0. A 1 means the account is disabled, which also happens after failed activations (see users deactivated for no reason).
• activation should be empty for an active account.
• requireReset set to 1 is fine: Joomla will ask for a new password right after you log in. It is actually useful here, because it forces you to replace the temporary one.

UPDATE x7k2p_users
SET block = 0, activation = '', requireReset = 1
WHERE id = 42;

Is the account still a Super User?

Sometimes the password is fine and the account simply lost its group. Look at the group mapping:

SELECT m.group_id, g.title
FROM x7k2p_user_usergroup_map m
JOIN x7k2p_usergroups g ON g.id = m.group_id
WHERE m.user_id = 42;

On a standard install the Super Users group has id 8. Check the title in x7k2p_usergroups before you rely on that number, then add the mapping if it is missing:

INSERT INTO x7k2p_user_usergroup_map (user_id, group_id)
VALUES (42, 8);

Locked out by the second login step

Since Joomla 4.2 the multi-factor settings live in their own table, one row per method per user. If you lost the authenticator and have no backup codes, delete the user's rows:

SELECT id, method, title FROM x7k2p_user_mfa WHERE user_id = 42;
DELETE FROM x7k2p_user_mfa WHERE user_id = 42;

The next login asks only for the password. Set up multi-factor again straight after, and this time print the backup codes. The setup is in two-factor login without an extension.

Blocked by a security extension

If the login page itself does not load, or says your IP address is blocked, the core is not the problem. Firewall extensions such as Admin Tools or RSFirewall keep their own lists of banned addresses in their own database tables. Look for a table with ban or block in the name and remove your IP address from it, or rename the extension's plugin folder over FTP for a moment so it stops loading. Rename it back once you are in.

Once you are back in

• Replace the temporary password with a long one and store it in a password manager the whole team can reach.
• Create a second Super User account for emergencies, with a different e-mail address, so one lost phone does not lock everyone out.
• Open Users > User Actions Log and check who logged in and what changed while you had no access. More in the user actions log.
• If you do not recognise accounts in the list, read mystery user accounts in Joomla 4 before you do anything else.

One last thing: anyone with access to your database can do everything in this article. Treat the hosting control panel and the phpMyAdmin login with the same care as the Super User password, because in practice they are the same key.