WordPress forgotten password localhost hack
This article is more than 4 years old.
I have lost count of the number of times I've forgotten the password to the local or development CMS.
My natural instinct is to click the Forgot Password link but, obviously, there's no way to trigger that email from the local system.
I've spent too long hunting through articles on how to recover the forgotten password. The quickest and easiest solution that I've found is to change the password manually in the database.
How do we do that then?
WordPress stores passwords in the wp_users table. The prefix may be different if you have elected to change that in the wp-config.php file. It's good practice to do that for security.
When you look at the table, it'll look a little like this…
| ID | user_login | user_pass |
|---|---|---|
| 1 | hryggrbyr | $P$BHpcLw/aWsTPmeDprzXwOEl45bJm9A3 |
WordPress stores your password as an MD5 hashed string. This prevents anyone with access to the database seeing confidential information in plain text.
WordPress salts the password using PHPass (as you can see from the $P$ at the start of the example password)*. This hack will still work though as, even if your password has been salted, you can still replace the password with an MD5 hash, and WordPress will let you log in.
If this wasn't obfuscated like this, we'd be able to copy our password and paste it into the login form…but we can't - and for good reason!
So, to fix our little problem, we need to replace the existing hashed password with a new hashed password - we can't overwrite the MD5 hash with plain text because that won't work.
I have Hasher installed as a plugin in VS Code. If you don't use VS Code or don't want to use this extension, MD5 Hash Generator Online works pretty well.
I would recommend that you don't create your "forever password" using these hash generators though. Overwrite the existing password with something easy to remember and very, very temporary - a favourite of mine is Pa55word! —
267057150e34eca5c6af39ec9b30864eOnce the password has been changed, you can log in with your new password and immediately change it to something more secure.
I hope this helps you as much as it has helped me. 😎
* Thanks to @sorinmarta for pointing out this detail when I cross-posted this to my Dev.to.
Fin
Kudos
I've previously lamented that there isn't an easy way to say "I liked this post" outside of social media so I'm doing my bit to make it easier.
So, if you liked this post, click the button. You don't have to but I'd be ever so grateful!
Real. Simple. Syndication.
Get my latest content in your favorite RSS reader.
I use InoReader but you don't have to.
Comments
In almost all cases, the comments section is a vile cesspool of Reply Guys, racists, and bots.
I don't want to have to deal with that kind of hell so I don't have a comments section.
If you want to continue the conversation, email me at reply at thomasrigby dot com, or you can always hit me up on the Socials™ (which is not a vile cesspool of Reply Guys, racists, and bots).