Hopefully this should be a quickly resolvable query:

If I only have phpMyAdmin as a means of changing a password - e.g. say I can't login and need to change the Admin password (and Drush is equally not available etc) should I be able to reset a user's password using the following query:

UPDATE drupal_users SET pass = SHA2( 'the_password', 256 ) WHERE uid = 20

where the drupal tables are prefixed with "drupal_"

I have tried the above query in order to change the password for a user, but when using the password specified in the above sql statement I am still unable to login. This makes me think I am missing something here.

Anyone got any ideas how to change a drupal 7 user password via PhpMyAdmin using SQL?


3 Answers 3


Drupal 7 uses a hash salt (see your settings.php) in addition to several other bit of information in order to create a SHA2 of the users PW. You should really use drush to change a user's pw if you need to.


If you have some other Drupal user account access to the site with enough rights, you can generate new hash as follows: Create any content page with PHP text format and put there:

require_once DRUPAL_ROOT . '/' . variable_get('password_inc', 'includes/password.inc');
print('Hash: ' . user_hash_password('my_password'));

Otherwise, if we don't have any Drupal user access or file access I am afraid we are in trouble, because the hash salt is stored in the config file.

  • 1
    If you’re bootstrapped far enough to use variable_get wouldn’t you just update the relevant user entity at this point too? Otherwise it’s still a manual job to get it into the database
    – Clive
    Dec 18, 2017 at 17:54
  • You are right, but, as far as I understand, we've got phpMyAdmin, so I wouldn't bother to write the code for DB update risking to mess up the user table. Dec 18, 2017 at 19:18
  • I meant with user_load/user_save. Manipulating entity data directly is not a smart move unless you really know what you’re doing and what the risks are
    – Clive
    Dec 18, 2017 at 19:22
  • That would definitely be an option, I agree. But, anyway, the main question is if we have any other access besides phpMyAdmin. Dec 18, 2017 at 19:26
  • 1
    Agreed. I think "don't do that, use the API instead" is a valid response though, even if we don't know for sure the OP has other means of access. Try to save people from themselves and all that...
    – Clive
    Dec 18, 2017 at 19:48

If you have a local version with the same setting.php / salt hash, you can use the password-hash script. This will generate a new hashed password that can be inserted via SQL.

All this is explained in the docs.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.