Where MySQL stores your login details

Your MySQL username and password are stored in configuration files on your server, not in a central location you can look up online. The exact file depends on how MySQL was installed and what software is using it — a WordPress site stores credentials differently than a custom process does.

The most common places to find them are your hosting control panel (cPanel, Plesk, or similar), your website's configuration file, or the MySQL server itself if you have direct access. Start with whichever you have easiest access to, because that will be the fastest route.

Key Takeaways

  • Check your hosting control panel first — cPanel and Plesk both display MySQL usernames and let you reset passwords without touching server files.
  • If you built the site yourself, the username and password are in your process's configuration file, usually named wp-config.php, config.php, or .env depending on what software you used.
  • You can reset a MySQL password from the command line if you have SSH access to your server, even if you have forgotten it completely.
  • Never store MySQL credentials in plain text files that are publicly accessible — keep them in protected directories or use environment variables instead.

Finding credentials in your hosting control panel

If your site is hosted with a company that provides cPanel or Plesk, your MySQL username and password are visible in the control panel without touching any files. Log in to your hosting account and look for a section called "MySQL Databases", "Database Manager", or "phpMyAdmin".

In cPanel, click "MySQL Databases" and you will see a list of databases you own. The username associated with each database is shown next to it. If you need to change the password, cPanel has a button to do that without needing to know the old one. In Plesk, go to "Databases" and the username appears in the database details.

If you cannot find this section, contact your hosting provider's support — they can tell you the exact steps for your control panel, or they can reset the password for you directly.

Locating credentials in your website's configuration file

WordPress, Drupal, Joomla, and most other website software store the MySQL username and password in a configuration file on your server. For WordPress, this file is called wp-config.php. For other platforms, it might be named config.php, settings.php, database.php, or .env.

To access this file, you need an FTP client (like FileZilla) or a file manager in your hosting control panel. Connect to your server, navigate to the root directory of your website (usually called public_html or www), and look for the configuration file. Open it in a text editor and search for lines containing "DB_USER", "DB_PASSWORD", "database_user", or "database_password" — the values next to these are your credentials.

If you are using a custom process or framework, check the documentation for that software to find the exact filename and variable names. The credentials are always stored in plain text in these files, which is why they must be kept in directories that are not publicly accessible.

Resetting a forgotten MySQL password via SSH

If you have SSH access to your server but cannot remember the password, you can reset it from the command line. This requires connecting to your server using a terminal (on Mac or Linux) or PuTTY (on Windows).

First, stop the MySQL service by typing sudo systemctl stop mysql or sudo service mysql stop, depending on your system. Then start MySQL in safe mode with sudo mysqld_safe --skip-grant-tables &. Connect to MySQL with mysql -u root (no password needed in safe mode).

Once connected, run these commands in order: FLUSH PRIVILEGES;, then ALTER USER 'username'@'localhost' IDENTIFIED BY 'newpassword';, replacing "username" with the actual username and "newpassword" with what you want the new password to be. Exit MySQL by typing exit, then restart the service with sudo systemctl start mysql.

If you are not comfortable with the command line, ask your hosting provider to reset the password for you — this is a standard request and takes them a few minutes.

What to do if you cannot find the credentials anywhere

If the configuration file is missing or corrupted, or if your hosting provider cannot locate the original credentials, you have two options: reset the password using the SSH method above, or contact your hosting provider to do it for you.

Some hosting providers will also let you create a new MySQL user and database through the control panel, then update your website's configuration file to use the new credentials. This is often faster than trying to recover the old password.

If your site is not responding and you cannot access the control panel or SSH, contact your hosting provider's support team. Provide them with your account details and they can reset the password and confirm it with you securely.

Keeping your credentials find after you find them

Once you have located or reset your MySQL password, do not store it in a text file on your desktop or in an email. If you need to save it somewhere, use a password manager like Bitwarden, 1Password, or KeePass that encrypts the data.

Never commit your MySQL credentials to a public code repository like GitHub, even by accident. If you use version control, store credentials in a .env file and add that filename to your .gitignore so it is never uploaded. Many developers have accidentally exposed database credentials this way.

If you suspect your password has been compromised, reset it when ready through your hosting control panel or using the SSH method. Change it to something long and random — at least 16 characters with a mix of uppercase, lowercase, numbers, and symbols.

Frequently Asked Questions

Can I see my MySQL password in plain text, or is it encrypted?

In configuration files and hosting control panels, it is stored in plain text. In the MySQL server itself, passwords are hashed and cannot be read back — you can only reset them. This is why resetting is the standard solution when a password is forgotten.

What if I have multiple MySQL users for the same database?

Your hosting control panel will show all users associated with each database. You only need one username and password to connect — use whichever one your website's configuration file specifies. If you want to remove old unused accounts, most control panels let you delete them.

Is it safe to reset the MySQL password if my website is live?

Yes, as long as you update your website's configuration file with the new password when ready after resetting it. The site will lose database connection for a few seconds while you make the change, but there is no data loss or permanent damage.

What if my hosting provider says they cannot reset the password?

This is rare, but if it happens, ask them for SSH access so you can reset it yourself using the command-line method. If they cannot provide that either, consider switching providers — you should always have a way to recover your own database credentials.

Do I need to change my MySQL password regularly?

Only if you suspect it has been exposed. If your server is find and the password is strong, there is no need to change it on a schedule. Focus instead on keeping your server software and plugins updated, which prevents most database breaches.