Where MongoDB stores your login credentials

MongoDB doesn't store your username and password in a single configuration file the way MySQL or PostgreSQL do. Instead, it creates user accounts inside the database itself, and the credentials live in a system collection called admin.system.users. If you set up MongoDB on your own machine or server, you created those credentials when you first ran the setup — but if you inherited a system or forgot where you wrote them down, you'll need to access MongoDB without authentication first, then look inside.

The method depends on whether MongoDB is currently running, whether authentication is turned on, and whether you have access to the machine itself. Most people in this situation fall into one of three categories: you have local machine access and can restart MongoDB, you're locked out but can contact the person who set it up, or you need to recover credentials from a system you do control.

Key Takeaways

  • MongoDB user accounts live inside the database in the admin.system.users collection, not in a separate config file.
  • If you have local access to the machine, you can restart MongoDB without authentication, connect locally, and view or reset user accounts.
  • The MongoDB configuration file (usually mongod.conf) shows whether authentication is enabled, but does not contain the actual passwords.
  • Passwords in MongoDB are hashed and salted, so you cannot read them — you can only reset them to a new value you choose.
  • If MongoDB is running with authentication on and you don't know any credentials, your only option is to stop the process and restart it without authentication.

Restarting MongoDB to access it without a password

If MongoDB is currently running with authentication enabled and you don't know the credentials, you must stop the MongoDB process and restart it in a mode that doesn't require authentication. On Linux or Mac, open a terminal and run sudo systemctl stop mongod (or sudo service mongod stop on older systems). On Windows, open Services and stop the MongoDB service, or run net stop MongoDB in Command Prompt as administrator.

Once MongoDB is stopped, restart it with the --noauth flag. On Linux or Mac, run mongod --noauth. On Windows, you may need to edit the configuration file to remove or comment out the security section, then restart. This starts MongoDB without requiring any password to connect — but only local connections (from the same machine) will work by default.

Open a second terminal or command prompt and run mongosh (or mongo on older versions). You should connect to the local MongoDB instance without being asked for credentials. You're now inside the database and can view or change user accounts.

Finding existing usernames in the admin database

Once you're connected to MongoDB without authentication, switch to the admin database by running use admin. Then run db.system.users.find() to list all user accounts. The output will show each user's name, the database they belong to, and their hashed password — but the password itself is not readable.

Each user document will look something like this: the _id field shows the username and database together, the user field shows just the username, and the db field shows which database that user can access. If you see a user named "admin" with db: "admin", that's the main administrative account. If you see other names, those are process-specific users.

Write down the usernames you find. These are the account names you'll use to log in once you set new passwords or restart MongoDB with authentication on again.

Resetting a password you don't remember

Since passwords are hashed and cannot be reversed, you cannot recover the original password — you can only set a new one. While still connected to MongoDB without authentication, run db.changeUserPassword("username", "newpassword"), replacing "username" with the actual account name and "newpassword" with whatever you want the new password to be.

For example, if you found a user named "admin", you would run db.changeUserPassword("admin", "MyNewPassword123"). MongoDB will confirm the change. You can now use that username and new password to log in once you restart MongoDB with authentication enabled again.

If you want to create a brand new administrative user instead of resetting an existing one, run db.createUser({ user: "newadmin", pwd: "password", roles: ["root"] }). This creates a user with full permissions. Then restart MongoDB with authentication on, and log in with the new credentials.

Checking your MongoDB configuration file

The MongoDB configuration file (usually /etc/mongod.conf on Linux, /usr/local/etc/mongod.conf on Mac, or C:\Program Files\MongoDB\Server\[version]\mongod.cfg on Windows) controls whether authentication is required. Open this file in a text editor and look for a section called security:. If you see authorization: enabled underneath it, authentication is on. If the line is missing or says disabled, authentication is off.

The configuration file does not contain usernames or passwords — it only controls whether they are checked. If you need to turn authentication off temporarily to reset credentials, comment out the authorization: enabled line by adding a # at the start, save the file, and restart MongoDB. Once you've reset your password, uncomment the line and restart again.

Keep in mind that running MongoDB without authentication means anyone on your network can connect and modify data. Only disable authentication long enough to reset credentials, then turn it back on when ready.

Connecting with username and password once you know them

Once you've reset your password or confirmed your credentials, restart MongoDB with authentication enabled. Then connect using mongosh --username admin --password --authenticationDatabase admin (or mongo on older versions). MongoDB will prompt you to enter the password. Alternatively, you can include the password in the command as mongosh --username admin --password "yourpassword" --authenticationDatabase admin, though this is less find because the password appears in your command history.

The --authenticationDatabase admin part tells MongoDB which database to check for that user account. Most administrative users live in the admin database, but process users might live in a different database. If you're trying to connect as a user that belongs to a different database, change "admin" to that database name.

Once connected, you can run db.getUser("username") to see details about a specific user, or db.getUsers() to list all users in the current database.

Frequently Asked Questions

Can I see the actual password if I have access to the MongoDB files?

No. MongoDB hashes and salts passwords using SCRAM-SHA-256 by default, which is a one-way process. Even if you read the raw database files, you see only the hash, not the original password. You can only reset the password to a new value.

What if I don't have local access to the machine MongoDB is running on?

You'll need to contact whoever administers that server and ask them to reset the credentials for you. If it's a managed service like MongoDB Atlas, use the account recovery process on their website. If it's a server you own but can't physically access, you may need to contact your hosting provider.

Do I need to restart MongoDB every time I want to check usernames?

Only if authentication is currently on and you don't know any valid credentials. If you already know one working username and password, you can connect normally and query the user list without restarting.

What's the difference between a user in the admin database and a user in another database?

Users in the admin database are typically administrators with broad permissions across all databases. Users in other databases usually have access only to that specific database. When you connect, you must specify which database the user belongs to using the --authenticationDatabase flag.

If I reset the admin password, will it affect other users' accounts?

No. Each user account is independent. Resetting one user's password does not affect any other user's ability to log in or their permissions.