Where Django stores admin credentials

Django does not store admin usernames and passwords in a single readable file. Instead, it hashes passwords in the database — usually a file called db.sqlite3 if you are using the default setup, or in a PostgreSQL or MySQL database if your site is hosted elsewhere. The username itself is stored in plain text, but the password is encrypted in a way that cannot be reversed.

This means you cannot straightforward open a file and read your password back. You have three realistic paths: reset the password through Django's command line, check your email for a password reset link if the site is live, or contact whoever set up the site if you do not have command-line access.

Key Takeaways

  • Django passwords are hashed and cannot be read from files or databases — you must reset them rather than recover them.
  • If you have command-line access to the server, you can create a new admin account or reset the existing one using Django's management commands.
  • If the Django site is live and you remember the email address, you can use the password reset form on the login page.
  • If you have neither command-line access nor email access, you will need to contact the person who manages the site.
  • The username is always visible in the Django admin interface once you are logged in, so you only need to recover the password.

Resetting the password from the command line

If you have access to the server where Django is running — either because you manage it yourself or through SSH — you can reset an admin password in seconds. Open a terminal and navigate to the folder where your Django project lives (the one containing manage.py).

Run this command, replacing admin with the actual username if it is different:

python manage.py changepassword admin

Django will prompt you to enter a new password twice. You do not need to know the old password. Once you confirm, the change takes effect when ready and you can log in with the new password.

If you do not know the username at all, you can list all admin accounts first by running:

python manage.py shell

Then inside the shell, type:

from django.contrib.auth.models import User; print([u.username for u in User.objects.filter(is_staff=True)])

This shows every staff member username. Type exit() to leave the shell, then use the changepassword command with the correct username.

Creating a new admin account if you cannot find the old one

If the existing admin account is lost and you cannot reset it, you can create a brand new one from the command line. Run:

python manage.py createsuperuser

Django will ask for a username, email address, and password. Fill these in with whatever you want — this new account will have full admin access. Once created, you can log in when ready with these credentials.

You can then delete the old admin account from inside the Django admin panel if you want to clean up, or leave it disabled. The new account works right away.

Using the password reset form on a live site

If the Django site is running on the internet and you remember the email address associated with the admin account, look for a "Forgot password?" link on the login page. Click it and enter the email address.

Django will send a password reset link to that email. The link is valid for a set time (usually 24 hours, depending on how the site was configured). Click the link, enter a new password, and you are back in.

This only works if the site has email sending configured and the email address is correct. If you do not receive an email after a few minutes, check your spam folder or move to the command-line method instead.

Checking environment files for database credentials

If you need to access the database directly to understand what is stored, look for a file called .env in the Django project folder. This file often contains database connection details like the database name, username, and password.

Open it in a text editor and look for lines like DATABASE_URL, DB_NAME, DB_USER, or DB_PASSWORD. These tell you how to connect to the database, but they do not help you read the hashed passwords — you still need to reset them using one of the methods above.

If the file does not exist or is empty, the database credentials may be set in a file called settings.py inside the Django project. Look for a DATABASES section with similar information.

What to do if you have no access to the server

If the Django site is hosted by someone else and you do not have SSH access or command-line tools, your options narrow. First, try the password reset form on the login page with the email address you used to set up the account.

If that does not work, contact the person or team that manages the site. They can reset the password for you using the same command-line method described above, or they can create a new admin account. Provide them with your email address and ask them to send you a temporary password or a reset link.

If the site is abandoned or the manager is unreachable, you may not be able to recover access without rebuilding the site or restoring from a backup.

Why Django hashes passwords and what that means

Django hashes passwords so that even if someone steals the database, they cannot read the actual passwords. A hash is a one-way function — you can check whether a password is correct by hashing it again and comparing, but you cannot reverse it to see the original.

This is why there is no "recover password" option in Django — the system genuinely does not know what the password is. Reset is the only way. This is a security feature, not a limitation of the software.

Frequently Asked Questions

Can I see the password in the database if I open db.sqlite3?

No. Even if you open the database file, the password column shows a long string of characters (the hash), not the actual password. You cannot reverse it. You must reset the password using the command line or the password reset form.

What if I forgot the email address too?

If you have command-line access, use the changepassword command with the username you remember, or create a new admin account. If you have no access to the server, contact the site manager. The email address is not needed to reset the password from the command line.

Does Django send a confirmation email when I reset the password?

Not automatically. If you use the command-line changepassword command, the password changes silently with no email. If you use the password reset form on the login page, Django sends a reset link to the email address on file, but no confirmation after you set the new password.

Can I reset the password without restarting Django?

Yes. Password changes take effect when ready. You do not need to restart the server or reload anything — just log in with the new password.

What if the site is running on a shared hosting provider?

Ask your hosting provider for SSH access or a control panel where you can run commands. Most providers offer this. If they do not, ask them to reset the admin password for you, or use the password reset form on the login page if you remember the email address.