-

Forgot your Drupal admin password? Safe recovery options for Drupal 10 and 11

Drupal
Droptica Team
Droptica Team
04.12.2024

Losing your Drupal admin password blocks access to user management, content updates, module installs and security patches. This guide explains safe recovery paths for Drupal 10 and Drupal 11, legacy Drupal 7 sites, and the Drush and database methods teams still use when email reset is not an option. Treat every reset as a security task, not only a technical shortcut.

If you maintain a production site, start with our Drupal website audit checklist after you regain access. For broader hardening, see Drupal security modules and best practices and how to run Drupal updates safely.

In this article:

What should you do before resetting a Drupal admin password?

Admin password recovery affects site security, not only convenience. Before you change credentials, confirm who requested access, whether the account should still be active, and whether another user can issue a one-time login link from the UI.

For Drupal 10 and Drupal 11, the preferred path is usually Drush or a controlled one-time login link, not manual database edits. Direct database changes should be a last resort on a backup-aware environment, followed by a password change in the admin UI and a note in your change log if a support team manages the site.

Quick checklist before you start:

  • Confirm identity: verify the request with your internal owner or client contact.
  • Try UI reset first: use the password reset form when email delivery works.
  • Prefer Drush on D10/D11: faster and leaves a clearer audit trail than raw SQL.
  • Avoid sharing login links: one-time login URLs must not go to public channels or ticket systems visible to third parties.
  • Review permissions after login: check roles and recent user changes once you are back in.

Why is losing your Drupal admin password risky?

Without admin access you cannot manage users, edit content, install modules or apply security updates. That gap creates downtime for editors and leaves known vulnerabilities unpatched until someone restores access.

The methods below work for Drupal 7 legacy sites and for supported Drupal 8 through Drupal 11 installations. Pick the lightest option that fits your hosting access: email reset, Drush, then database only if nothing else is available.

How do you reset the admin password in Drupal 7?

Drupal 7 reached end of life, but many archives and intranets still run it. If you maintain a Drupal 7 site past end of life, plan migration while you restore access. These recovery steps remain valid for emergency access.

How does the one-time login link work in Drupal 7?

Drupal 7 can generate a one-time login link (the "request new password" flow):

  1. Go to the user login page (/user/login).
  2. Click the "Request new password" tab.
  3. Enter your username or email address.
  4. Check your email for the one-time login link.
  5. Follow the link to log in and set a new password.

This method is the safest when the admin mailbox is reachable. It avoids direct database edits entirely.

How do you reset a Drupal 7 password via the database?

If you cannot access the admin email, you can update the password hash in the database. This is an emergency path only.

  1. Access your Drupal database with phpMyAdmin, Adminer or the CLI.
  2. Open the users table.
  3. Find the admin user record (often uid 1).
  4. Generate an MD5 hash for the new password.
  5. Update the pass field with the hash.

Example SQL command:

UPDATE users SET pass = MD5('newpassword') WHERE uid = 1;

Replace newpassword with your desired password, then log in and change it again in the UI. Drupal 7 MD5 hashes are weak by modern standards, which is one more reason to migrate off D7.

How do you recover a Drupal 7 password with Drush?

Drush is a command-line tool for Drupal site management. On Drupal 7 use:

  1. Open a terminal on the server.
  2. Change to the Drupal root directory.
  3. Run:
drush upwd admin --password="newpassword"

Replace admin with the actual username if it differs. To discover the username or skip password typing, generate a one-time login link:

drush uli

Paste the URL into a private browser window, log in once, then set a new password. Read also: your own Drush command in Drupal for more CLI workflows.

How do you recover the admin password in Drupal 10 and 11?

Drupal 8 and newer stores users in users_field_data and uses stronger password hashing. The same recovery patterns apply to Drupal 9, Drupal 10 and Drupal 11; commands below were verified for current Drush releases on supported versions.

How does the one-time login link work in Drupal 10 and 11?

The UI flow matches Drupal 7:

  1. Visit /user/login.
  2. Select "Request new password".
  3. Enter your username or email.
  4. Open the one-time login link from your inbox.
  5. Set a new password when prompted.

Check spam folders and mail server logs if the message does not arrive. SMTP misconfiguration is a common reason teams escalate to Drush or database recovery.

How do you reset a Drupal password via the database?

Manual database reset on Drupal 10 or 11 requires a proper password hash, not plain text. Use this only when Drush and email reset are unavailable.

  1. Connect to the site database.
  2. Open the users_field_data table.
  3. Locate the admin user (uid 1).
  4. Generate a hash on the server:
php core/scripts/password-hash.sh 'newPassword'
  1. Update the pass field with the generated hash.
  2. Clear the user cache entry for uid 1.

Example SQL (replace the hash with your generated value):

UPDATE users_field_data SET pass='$S$...generated_hash...' WHERE uid = 1;
DELETE FROM cache_entity WHERE cid = 'values:user:1';

Log in, change the password again in the UI, and review recent account changes. You can perform the same update through phpMyAdmin if CLI access is limited.

How do you reset a Drupal password with Drush?

On Drupal 10 and 11, Drush is usually the fastest supported recovery option:

  1. Open a terminal on the server.
  2. Go to the Drupal root directory.
  3. Run one of the following (syntax depends on your Drush major version):
drush user:password admin "newpassword"

Older Drush releases also accept:

drush user-password admin --password="newpassword"
  1. Log in with the new password and rotate it in the UI.

To generate a one-time login link instead:

drush uli

For custom automation around Drush, see creating custom Drush commands in Drupal.

What additional resources help with Drupal password security?

Password recovery is only one part of site security. After you restore access, review modules, updates and login hardening.

Read also: audit your Drupal website with our control list and use Docker for Drupal development to test recovery steps safely on a local copy before touching production.

Need help securing or recovering access to your Drupal site?

We help teams regain admin access, harden login flows and keep Drupal 10 and 11 sites patched on production hosting. That includes emergency recovery, post-incident reviews, role audits and ongoing maintenance when you do not have in-house Drupal ops capacity.

Need a safer recovery path or a security review after a lockout? Visit our Drupal support services page or explore Drupal development services for long-term site care. For a structured review after you log back in, start with our Drupal website audit checklist.

-
Check related blog posts