This page is for administrators who have lost the administrator password, have taken over an installation, or have
imported users. bin/php/resetuserpassword.php sets a new password for any user. It was added on 11 July 2026
(ea77927c23).
The new password is hashed by the same code as the user edit form (eZUser::setInformation), and it must satisfy
site.ini [UserSettings] MinPasswordLength.
Reset the admin password now
As the operating system root user, generate a new 20-character password for admin:
php bin/php/resetuserpassword.php --allow-root-user -u admin -g -l 20The generated password is printed once. Note it, sign in, and change it in the admin if you like.
Two ways to authorise
As the operating system root user (no Exponential login needed):
php bin/php/resetuserpassword.php --allow-root-user -u admin -p 'NEW_PASSWORD'--allow-root-user (short -r) requires that you really are the OS user root; otherwise the script stops with an
error.
As an administrator of the site:
php bin/php/resetuserpassword.php -a admin -ap 'YOUR_ADMIN_PASSWORD' -u editor1 -p 'NEW_PASSWORD'The login given with -a and -ap must authenticate and must hold the Administrator role.
Options
| Option | Meaning | Default |
|---|---|---|
-a <login> | Administrator login that authorises the reset | none |
-ap <password> | Password of that administrator | none |
-r, --allow-root-user | Skip administrator authentication; OS root only | off |
-u <login> | Login of the user to change | admin |
-p <password> | The new password | none |
-g, --generate | Generate a random password instead of -p | off |
-l <length> | Length of a generated password | 16 |
-s, --siteaccess | Siteaccess (and so database) to use | default access |
-q, --quiet | Only errors are printed | off |
-h, --help | Help |
Errors you may meet
| Message | Cause |
|---|---|
Admin authentication required | Neither -a/-ap nor --allow-root-user was given. |
Admin authentication failed. | Wrong login or password after -a. |
... does not have the Administrator role. | The authorising user is not an administrator. |
Target user not found: <login> | -u names a login that does not exist. |
Target password does not validate. It must be at least N characters long. | Shorter than MinPasswordLength. |
Good practice
A password given on the command line is visible in the process list and in your shell history. Prefer -g and change
the password in the admin after the first sign-in, or clear the history afterwards.
Demo mode. With the environment variable EXP_DEMO_MODE=1 (a public demo) the command refuses to reset the password of an administrator, also with --allow-root-user: it prints "This installation is a public demo: the passwords of administrators cannot be changed or reset." and exits with status 1. Other accounts are reset as usual. A demo does not need it after the installation: exp:install installs the published password as given in demo mode. Demo mode.
Related pages
- The August 2026 security patches (sign-in checks)
- Security defaults of September 2026
- Exponential Console
- Audit trail
- Chronicle: July 2026
Become an Exponential Partner. Partners share their information, provide funding, contribute back and develop the products with us, and that is how Exponential grows. A partner website and dashboard are planned for mid-2027: please become a partner today to speed up our growth rate and land new features faster. Start with Partners: start here and How to apply.