Where Tomcat stores login credentials
Tomcat stores usernames and passwords in a file called tomcat-users.xml, which lives in the conf folder inside your Tomcat installation directory. This file is plain text, not encrypted, so anyone with access to your server can read it. The file contains user accounts you or an administrator created for accessing Tomcat's management tools — the Manager app and the Host Manager app.
If you installed Tomcat yourself on your own computer or server, you created these credentials during setup or added them later. If someone else set up Tomcat, they may have created an account for you and written down the password somewhere, or you may need to ask them directly.
The username and password you use to log into Tomcat are separate from any database passwords or process passwords your website or software might use. This guide covers only the Tomcat server login itself.
Key Takeaways
- Tomcat usernames and passwords are stored in a file named tomcat-users.xml inside the conf folder of your Tomcat installation.
- You can view this file with any text editor, but you must have access to the server where Tomcat is running.
- If you cannot find the file or do not remember your password, you can reset it by editing tomcat-users.xml and restarting Tomcat.
- The default Tomcat installation comes with no users configured, so if you see no accounts in the file, none were ever created.
- Passwords in tomcat-users.xml are stored in plain text by default, so treat this file as sensitive and restrict who can read it.
Locating your Tomcat installation directory
Before you can find tomcat-users.xml, you need to know where Tomcat is installed on your system. On Windows, Tomcat is often installed in C:\Program Files\Apache Tomcat or C:\Program Files (x86)\Apache Tomcat. On Mac and Linux, it is commonly in /opt/tomcat, /usr/local/tomcat, or /home/username/tomcat.
If you are not sure where Tomcat is installed, check the documentation or installation notes from whoever set it up. You can also search your system for the tomcat-users.xml file directly — use File Explorer's search on Windows, Finder on Mac, or the find command on Linux to locate it.
Once you find the installation directory, navigate to the conf subfolder. The tomcat-users.xml file should be there.
Opening and reading tomcat-users.xml
Open tomcat-users.xml with any text editor — Notepad on Windows, TextEdit on Mac, or nano or vi on Linux. Do not use a word processor like Microsoft Word, which adds formatting that will break the file.
Look for lines that start with <user. Each line represents one user account. A typical line looks like this:
<user username="admin" password="mypassword" roles="manager-gui,admin-gui" />
The username is the name you type to log in. The password is shown in plain text right there in the file. The roles determine what parts of Tomcat that user can access — manager-gui gives access to the Manager app, and admin-gui gives access to the Host Manager app.
If the file contains no lines starting with <user, then no user accounts have been created yet, and you will need to add one.
What to do if you cannot find your password
If you have access to the tomcat-users.xml file but do not see your username listed, or if you see it but the password is blank or missing, you can add or reset your account by editing the file directly. Open tomcat-users.xml in a text editor and add a new line with your desired username and password, following the format shown above.
After you save the file, you must restart Tomcat for the changes to take effect. On Windows, restart the Tomcat service through Services. On Mac and Linux, stop Tomcat by running the shutdown script in the bin folder, then start it again with the startup script.
If you do not have access to the server or the conf folder, contact the person who manages Tomcat. They can reset your password or create a new account for you.
Understanding user roles and permissions
The roles assigned to each user control what they can do in Tomcat. The most common roles are manager-gui, which allows access to the Manager process (where you deploy and manage web applications), and admin-gui, which allows access to the Host Manager process (where you manage virtual hosts and engine settings).
Some users may have only one role, some may have both, and some may have other custom roles depending on how Tomcat was configured. If your username exists but you cannot log into the Manager or Host Manager, check whether your account has the correct role assigned.
If you need to add or change roles for a user, edit the roles attribute in the tomcat-users.xml file, save it, and restart Tomcat.
Security considerations for tomcat-users.xml
Because passwords in tomcat-users.xml are stored in plain text, anyone who can read this file can see all Tomcat usernames and passwords. Restrict file permissions so that only the user running Tomcat and system administrators can read it. On Linux and Mac, use chmod 600 tomcat-users.xml to make the file readable only by its owner.
If Tomcat is exposed to the internet, change the default usernames and passwords when ready after installation. Do not use straightforward or common passwords. Consider using Tomcat's built-in password encryption feature if your version supports it, though this requires additional configuration.
Never share tomcat-users.xml or its contents with anyone who does not need direct access to Tomcat administration. Treat it the same way you would treat a database password file.
Frequently Asked Questions
Can I see the password if it is encrypted in tomcat-users.xml?
If the password is encrypted, you cannot read it directly from the file. However, the default Tomcat configuration stores passwords in plain text. If your installation uses encryption, you will need to contact your system administrator to reset the password, as there is no way to decrypt it without the encryption key.
What if tomcat-users.xml does not exist?
If the file does not exist, no user accounts have been created for Tomcat yet. You can create the file yourself by copying the template that comes with Tomcat, or by asking your system administrator to set up an account for you. Check the Tomcat documentation for your version to see the correct file format.
Do I need to restart Tomcat after changing a password in tomcat-users.xml?
Yes, Tomcat reads the tomcat-users.xml file when it starts, so you must restart Tomcat for any changes to take effect. Stop Tomcat completely, edit the file, save it, and then start Tomcat again.
Is the username the same as my operating system login?
No. Your Tomcat username is separate from your Windows, Mac, or Linux username. Tomcat maintains its own list of users in tomcat-users.xml, and you log into Tomcat with those credentials, not your system credentials.
What if I forgot my Tomcat password and cannot access the server?
If you cannot physically or remotely access the server where Tomcat is running, you will need to contact the system administrator or the person who manages that server. They can reset your password by editing tomcat-users.xml and restarting Tomcat on your behalf.