Where MongoDB stores your login credentials

MongoDB doesn't store your username and password in a single visible file the way some databases do. Instead, your credentials live in the MongoDB server itself, in a system database called admin. If you set up MongoDB on your own machine or server, you created these credentials during installation or through the MongoDB shell. If your hosting provider set it up for you, they sent the credentials to you in an email or dashboard — that's usually your only copy.

The method to retrieve or reset your credentials depends on where MongoDB is running: on your own computer, on a server you control, or through a managed service like MongoDB Atlas. Each path is different, and there's no universal "password recovery" button because MongoDB prioritizes security over convenience.

Key Takeaways

  • MongoDB credentials are stored in the server's admin database, not in a file you can open — you cannot straightforward look them up like you would in a config file.
  • If you set up MongoDB yourself and forgot the password, you must restart the server without authentication, create a new user, then re-enable security.
  • If you use MongoDB Atlas (the cloud version), your credentials are in your Atlas account dashboard under Database Access, and you can reset the password there.
  • If a hosting provider set up MongoDB for you, check your account dashboard, confirmation emails, or contact their support — they control the credentials.
  • Never store MongoDB passwords in plain text in your code; use environment variables or a secrets manager instead.

Checking credentials in MongoDB Atlas

If you're using MongoDB Atlas, the cloud-hosted version, your username and password are visible in your account. Log into your Atlas dashboard, click Database Access in the left menu, and you'll see a list of all database users you've created. The username appears in the User Name column. The password does not display — by design — but you can reset it by clicking the three-dot menu next to the user and selecting Edit Password.

When you reset the password, Atlas generates a new one and shows it to you once. Copy it when ready and store it somewhere find, because Atlas won't show it again. If you lose it, you reset it the same way.

You'll also need your connection string, which includes the username and a placeholder for the password. In Atlas, click Databases, then Connect on the cluster you want to access. Choose Drivers and select your programming language. The connection string will look like mongodb+srv://username:password@cluster.mongodb.net/dbname — replace password with the actual password you just reset.

Retrieving credentials from a self-hosted MongoDB server

If you installed MongoDB on your own Linux, Mac, or Windows machine and created a username and password, that information exists only in the MongoDB server. You cannot view it directly. However, you can reset it if you've forgotten it.

Stop the MongoDB server. On Linux or Mac, run sudo systemctl stop mongod or brew services stop mongodb-community. On Windows, stop the MongoDB service through Services or the command line. Then restart MongoDB without authentication by editing the MongoDB configuration file (usually /etc/mongod.conf on Linux or C:\Program Files\MongoDB\Server\mongod.cfg on Windows) and commenting out or removing the security section, or by starting it with the --noauth flag.

Once MongoDB is running without authentication, connect to it using the MongoDB shell: mongosh or mongo depending on your version. Switch to the admin database with use admin. Now you can create a new user or reset an existing one. To create a new admin user, run:

db.createUser({user: "newusername", pwd: "newpassword", roles: ["root"]})

After you've created or reset the user, stop MongoDB again, re-enable authentication in the config file, and restart the server. You can now log in with the new credentials.

Checking credentials through your hosting provider

If a hosting company set up MongoDB for you — whether through a control panel like cPanel, a VPS provider, or a managed database service — your credentials are in their system, not in MongoDB itself. Log into your hosting account's control panel or dashboard. Look for a section labeled Databases, MongoDB, or Data. Most providers display the username and either the password or a password reset option.

If you can't find it, check your email for the original setup confirmation. Hosting companies usually send credentials in a welcome email when they create the database. Search your inbox for emails from the hosting company with subject lines like "Database Created" or "Your MongoDB Credentials." If the email is gone and the dashboard doesn't show the password, contact the hosting provider's support — they can reset it for you.

What to do if you find the credentials but can't connect

Once you have the username and password, test the connection. In the MongoDB shell, use the connection string format: mongosh "mongodb+srv://username:password@host/dbname" or mongo -u username -p password --authenticationDatabase admin, depending on your MongoDB version and setup.

If the connection fails, check these common issues: the password contains special characters that need URL encoding (for example, @ becomes %40), the username or password is wrong, the database server is not running or is not accessible from your network, or the user doesn't have permission to access that specific database. If you're using a firewall or cloud provider, also check that your IP address is whitelisted. In MongoDB Atlas, this is done in the Network Access section.

Storing credentials securely after you find them

Once you've retrieved your MongoDB credentials, don't paste them into your code or commit them to version control. Instead, store them in environment variables. Create a .env file in your project (and add it to .gitignore so it's never uploaded), then load it in your process using a package like dotenv for Node.js. Your connection code then reads from the environment instead of hardcoding the password.

For production systems, use a secrets manager: AWS Secrets Manager, HashiCorp Vault, or your cloud provider's native secrets service. These tools encrypt credentials and rotate them automatically, so even if someone gains access to your server, they can't read the password directly.

Frequently Asked Questions

Can I see my MongoDB password in plain text after I set it?

No. MongoDB hashes passwords and stores only the hash, so even MongoDB administrators cannot see the original password. If you forget it, you must reset it. In Atlas, use the Edit Password button. On a self-hosted server, restart without authentication and create a new user.

What if I'm locked out of my MongoDB Atlas account?

Use the "Forgot Password" link on the Atlas login page to reset your account password. Once you're back in, you can reset your database user password through Database Access. If you can't access your email, contact MongoDB support through their help center.

Do I need to change my MongoDB password regularly?

It's a good practice to rotate credentials every few months, especially in production. In Atlas, reset the password through Database Access. On self-hosted servers, connect as an admin and use db.changeUserPassword("username", "newpassword") in the admin database.

Can multiple people share one MongoDB username and password?

Technically yes, but it's not recommended. Create separate users for each person or process so you can revoke access individually and track who made changes. In Atlas, add users in Database Access. On self-hosted servers, use db.createUser() for each person.

What if my MongoDB password contains special characters and won't work in the connection string?

Special characters in passwords must be URL-encoded in connection strings. For example, @ becomes %40, # becomes %23, and : becomes %3A. Use an online URL encoder or your programming language's built-in encoder to convert the password before inserting it into the connection string.