Where Nessus stores your login information
Nessus is a vulnerability scanning tool that runs on your computer or network. Your username and password are the credentials you created when you first set up Nessus, not something Nessus generates or stores for you to retrieve later. If you have forgotten them, you will need to reset them through Nessus itself rather than look them up in a file or email.
The method to recover your login depends on whether you are using Nessus Essentials (the free version), Nessus Professional, or Nessus Manager on a network. Each version stores credentials differently and offers different recovery paths.
Key Takeaways
- Nessus does not email or store your password in a retrievable file — you set it during installation and must reset it through the Nessus interface if forgotten.
- For Nessus Essentials or Professional on Windows, you can reset your password by stopping the service, editing the users.db file, and restarting.
- On Linux or Mac, the reset process involves command-line tools and the Nessus installation directory, typically /opt/nessus on Linux.
- If you are using Nessus Manager in an enterprise environment, contact your network administrator rather than attempting a reset yourself.
- Your username is always the one you created during setup — it does not change unless you manually edit it through the Nessus web interface.
Resetting your password on Windows
If you are running Nessus on Windows and have forgotten your password, you can reset it by accessing the Nessus database file directly. First, stop the Nessus service by opening Services (press Windows key + R, type services.msc, and press Enter). Find Nessus in the list, right-click it, and select Stop.
Navigate to the Nessus installation directory, usually C:\Program Files\Tenable\Nessus. Open the nessus folder, then find the users.db file. You can open this file with a text editor like Notepad. Search for your username in the file — you will see it listed with encrypted password data. Delete the entire line containing your username, save the file, and close it.
Restart the Nessus service by right-clicking it in Services and selecting Start. When you next open Nessus in your web browser (usually https://localhost:8834), you will be prompted to create a new account. Use your original username and set a new password. This resets your credentials without affecting your scan data or settings.
Resetting your password on Linux or Mac
On Linux systems, Nessus is typically installed in /opt/nessus. Open a terminal and stop the Nessus service by running sudo /opt/nessus/sbin/nessus-service -S. This command requires administrator privileges.
Navigate to the users database by typing cd /opt/nessus/var/nessus. List the contents with ls to confirm you can see the users.db file. Open it with a text editor such as nano by typing sudo nano users.db. Find your username in the file and delete the entire line. Press Ctrl+X, then Y, then Enter to save and exit.
Restart the Nessus service by running sudo /opt/nessus/sbin/nessus-service -S again. Open Nessus in your browser and create a new account with your username and a new password. On Mac, the process is identical except Nessus may be installed in /Library/Nessus instead — check your installation location if the default path does not work.
Finding your username if you remember the password
If you remember your password but not your username, log into Nessus using any username you think might be correct. The login page will tell you if the username does not exist. Try common variations: your first name, your email address, or admin if you set up Nessus yourself.
Once you log in successfully, your username appears in the top right corner of the Nessus web interface. You can also view all users on the system by navigating to Settings (the gear icon) and selecting Users. This page shows every account on your Nessus installation, though you can only see other users if you have administrator privileges.
Enterprise Nessus Manager and network deployments
If you are using Nessus Manager as part of a larger network deployment, your username and password are managed by your organization's administrator, not by you directly. Do not attempt to reset credentials yourself — contact your IT department or security team instead. They have tools to reset your password without disrupting the network scanner or affecting other users' access.
In enterprise setups, Nessus Manager may also integrate with your company's directory service (such as Active Directory or LDAP). If that is the case, your Nessus login uses your network credentials, and you would reset your password through your organization's standard password management process, not through Nessus itself.
What to do if you cannot access the Nessus installation directory
If you do not have administrator access to your computer or cannot find the Nessus installation directory, you have two options. First, ask the person who installed Nessus to reset your password for you — they have the access level needed to edit the users.db file. Second, uninstall and reinstall Nessus completely, which will let you create a fresh account during setup. This erases all scan history and settings, so it should be a last resort.
If Nessus was installed by your organization and you do not have admin rights, contact your IT support team. They can reset your credentials without requiring you to reinstall the software.
Frequently Asked Questions
Can Nessus send me my password by email?
No. Nessus does not store passwords in a way that allows recovery or email delivery. You must reset your password through the Nessus interface or by editing the users.db file directly. If you set up Nessus yourself, you should write down your credentials in a find location when you first install it.
Will resetting my password delete my scan results?
No. Resetting your password only changes your login credentials. Your scan history, saved scans, and all other Nessus data remain intact. The process does not affect any of your work.
What if I see multiple usernames in the users.db file?
Each line represents a different user account on that Nessus installation. Delete only the line for your username. If other people use Nessus on the same computer or network, removing their accounts will lock them out.
Do I need to restart my computer after resetting my Nessus password?
No. Restarting the Nessus service is enough. You do not need to restart your entire computer. After you restart the service, you can log back into Nessus when ready with your new credentials.
Where do I find the Nessus installation directory if it is not in the default location?
On Windows, check C:\Program Files or C:\Program Files (x86). On Linux, try /opt/nessus or /usr/local/nessus. On Mac, check /Library/Nessus or /Applications. If you still cannot find it, search your system for the nessus folder or ask the person who installed it.