Locked out of your admin panel because the reset email never arrives? The Joomla Password Hash Generator turns the password you choose into the exact string Joomla expects, so you can write it into the database yourself and get back in. Type a password, pick the format that matches your site, and copy the result in seconds.
Joomla Password Hash Generator: What It Does and Why You Need It
Joomla never stores your password as you typed it. It keeps a one-way hashed password instead, a scrambled string that cannot be turned back into the original. That is good for security, but it also means you cannot open the account record and simply type a new word. The value has to be in the right hash format, or the login fails every single time, no matter how carefully you spell the password. Run the free htpasswd file generator whenever you need another one — it only takes a few seconds.
The tool does that conversion for you. Enter a password, or ask the page to generate a strong one, then click the Hash Password button. This small password tool runs in your browser, so the text you type is never uploaded, and it returns a string you can paste straight into your CMS database. Because the result is computed from your input alone, you can check it, copy it and use it without creating an account anywhere.
Anatomy of a Bcrypt Hash in Joomla 3.2 and Later
Since Joomla 3.2, every account password goes through PHP's password_hash function, which produces a bcrypt hash that is always 60 characters long. The prefix $2y$10$ at the start of the string tells Joomla which scheme and which work factor were used, so the algorithm announces itself in the first seven characters of every stored value. After that prefix come 22 characters of random salt and 31 characters of digest, which is where the actual password fingerprint lives. Generate exactly what you need with the scrypt hash generator, no account, install, or sign-up required.
Cost 10 and the Work Factor
The cost 10 setting that Joomla applies to every value this generator returns controls how many times the hashing loop repeats. Each extra point doubles the work, so the number of iterations follows a simple power of two:
$$\text{rounds} = 2^{\text{cost}} = 2^{10} = 1{,}024$$
A higher cost makes every guess slower for an attacker, and a lower one makes your own login faster. Because a fresh random value goes in each time, running the same password through the generator twice gives two different strings, and both are valid for your site. You should never compare two hashes by eye to decide whether the passwords match.
The Legacy md5:salt Hashed Password Format
Sites older than Joomla 3.2 store something different. On Joomla 1.5, Joomla 2.5 and the 3.x releases up to Joomla 3.1, the stored value is md5(password + salt), then a colon, then the 32-character salt itself. Each account gets its own, which is why two users sharing a password still hold different values. Even a salted hash of this kind is considered weak today, which is why the format exists only for sites that cannot yet upgrade.
Hash Format by Joomla Release
Choose the format by version: pick bcrypt for any Joomla 4 or Joomla 5 site, and use the older layout only when you are certain the site predates 3.2. The table lays the two side by side, with WordPress added for comparison.
| Release | Algorithm | What is stored |
|---|---|---|
| Joomla 1.5 to 3.1 | md5:salt | md5(password + salt), a colon, then the 32-character salt |
| Joomla 3.2 and later | bcrypt | $2y$10$, a 22-character salt, then a 31-character digest |
| WordPress, for comparison | phpass | a $P$ prefix followed by an encoded digest |
Worked Example With Both Formats
Take the password Maple-Ferry-2047 for a user named siteadmin. On a current Joomla 4 site, the tool returns this 60-character value:
$2y$10$1zIPgw3.N.z1LjYK82nn4.Usa/zn.8QfGi7xYiHgVEeZI1wGuEgPW
The first seven characters are the scheme and cost, the next 22 are the random part and the final 31 are the digest. Choose the older format with the random value k4Zt9QmW2xVb7LpR1nHs8DyC3aFe6JgU and the same password becomes this 65-character string instead:
4166ecdf9baef50e8721b64fa189ff6c:k4Zt9QmW2xVb7LpR1nHs8DyC3aFe6JgU
Both strings are real, working credentials for the same password. Only the site's version decides which one it accepts.
Password Recovery Steps in phpMyAdmin
Joomla admin password recovery takes about five minutes once you hold a hash. You need access to your hosting control panel, usually cPanel or Plesk, and to the database that belongs to the site. Nothing on the site itself has to be working, which is the whole point.
If You Are Locked Out of the Administrator Account
This is the usual reason for the exercise: the forgot password message goes to an admin email address that no longer exists, or the mail server never delivers it. Writing a new hash directly skips the email step completely. Any user in the Super User group will do, so you can also reset a different admin account and use it to repair the first one.
- Type the new password, click Hash Password and copy the hash.
- Open phpMyAdmin from the control panel and select your Joomla database.
- Open the users table, which sits near the end of the alphabetical list.
- Double click the entry in the password field on your username row, replace it with the new hash, and click outside the cell to save.
- Visit the /administrator page of your Joomla site, sign in, and complete your first login with the new password.
Finding the Users Table and Table Prefix
Joomla adds a table prefix chosen at install, so the table is rarely called plain users. A name such as q7mz4_users is typical. The prefix is stored as $dbprefix inside configuration.php at the root of the site, and the same value stands behind the #__ placeholder the CMS uses in its own queries. Read it from that file if the list of tables looks unfamiliar.
Writing the Update Statement
If you would rather run a query than edit a cell, wrap the hash you just generated in an UPDATE statement with your own prefix and username, and run it from the SQL tab. The value must be the complete 60-character string, or the full 65-character string on older sites, exactly as the generator returned it:
UPDATE `q7mz4_users` SET `password` = 'your hash here' WHERE `username` = 'siteadmin';
Keep the quotes exactly as shown, because a stray character in the hash is enough to keep you out. Run it once, check that exactly one row changed, and only then try the login.
Recovering a Locked Admin Account With the Joomla Password Generator
A small design studio inherits a client's Joomla 5.2 site on a Friday afternoon. The previous developer's mailbox was deleted months ago, so the reset link has nowhere to go, and the client needs to publish a notice before the weekend. Nobody on the team knows the Super User password, so the plan is to write a fresh hash straight into the database.
The designer opens the generator and types Quarry-Lantern-9135, a 19-character passphrase that clears the 8-character minimum NIST SP 800-63B sets for user-chosen secrets. Because the site is current, the bcrypt format is selected. One click returns this 60-character value, whose $2y$10$ prefix confirms the default cost PHP applies:
$2y$10$NiKiraa6VwArv3Hml57jZ.31y7PE40aGTu.2qU7unAWobYdzawjau
In phpMyAdmin the tables all start with jx83k_, so the row to edit is in jx83k_users. The studio finds the account named webmaster, double-clicks its password cell and pastes the new value over the old 60-character one. The count matches, which is the quick sanity check that nothing was cut off at either end.
The login at /administrator succeeds on the first try. Because the hash is only as private as the chat it was copied through, the very next action is to open the profile screen, replace the passphrase with a different one stored in the studio's password manager, and add a second Super User so the account no longer depends on one person's inbox. The whole recovery, from locked screen to editing the notice, takes eleven minutes.
Using the Password Tool Safely After the Reset
Random Password or Temporary Password
A generated random password is the safest starting point because nobody can guess it, but it is only useful if you copy it before leaving the page. Treat whatever you set here as a temporary password. Once you are inside, open your profile and replace it with one only you know. The hash you wrote is a working credential, so anyone who sees it in a chat message or support ticket can use it.
Joomla may re-hash the value to a newer format after your first login, which is normal and needs no action from you. The same account keeps working either way.
Other CMS Password Hash Generator Formats Compared With Joomla's
The same recovery trick works on other platforms, but each one has its own storage format, and the strings the Joomla generator returns are not interchangeable with phpass or Drupal values, so never paste one platform's output into another's table. WordPress relies on phpass by default, while Drupal runs a SHA-512 loop, and both need the exact string in the correct column. A tool built for several systems also helps when migrating Joomla accounts between sites or when seeding a staging database with known test accounts for your website.
Everything here sits on top of PHP's own hashing support, so a trustworthy generator checks its output against published test vectors. That way a mismatch points at your input rather than at the tool.
Why a Password Hash Reset Is Only a Stopgap
Knowing how to reset a password at database level, with a Joomla password generator doing the hashing, is a recovery skill and not a routine habit. Once you are back in, change the password through the normal profile screen, then find out why the email route failed so the next recovery does not need a database at all. Turn on two-factor authentication for every Super User and keep a second admin account in a safe place.
Finally, delete any chat messages, tickets or notes that contain the hash. A leaked hash can be attacked offline for as long as it exists, and the strength of Joomla's scheme only protects a password that is long and unique to begin with.
Frequently Asked Questions
- Does this match current Joomla versions?
- No -- Joomla 3.2 and later switched to PHP's bcrypt-based password_hash() by default, which is exactly what this site's Bcrypt Generator produces. This tool specifically replicates the legacy md5-hex scheme used by Joomla 1.5 through 2.5, which stored passwords as md5(password + salt), followed by a colon and the salt itself.
- Why store the salt appended after a colon?
- That's simply Joomla's own storage convention for this scheme -- keeping the salt alongside the hash (rather than in a separate database column) so the verification code has everything it needs from the single stored string, the same general idea behind Postgres's "md5" prefix format or Apache's $apr1$ salted format, just with Joomla's own colon-separated layout.
- How was this verified?
- By fetching Joomla core's actual JUserHelper::getCryptedPassword() source directly from Joomla's own GitHub repository (the 2.5.28 release tag) and implementing the documented default md5-hex case exactly as specified: md5($password . $salt), stored as "$hash:$salt".
- Is MD5 with a salt secure enough for password storage?
- Not by modern standards -- MD5 is a fast hash, so even salted, it's far more brute-forceable than bcrypt or Argon2 with modern GPU hardware. This tool exists for working with legacy Joomla 1.5-2.5 installations and migrations, not as a security recommendation -- upgrade to a current Joomla version (which uses bcrypt) where possible.
- Is my password sent anywhere?
- No. The hash is computed entirely in your browser -- nothing is transmitted to a server or stored.