Where your database credentials are stored

Your SQL username and password live in one of three places: a configuration file on your web server, your hosting provider's control panel, or documentation you saved when you first set up the database. Most people find them fastest by checking their hosting account first, because the control panel usually displays both pieces of information without requiring you to dig through files.

If you built the database yourself on a local machine or a server you manage directly, the credentials are in a configuration file — typically named wp-config.php (for WordPress), .env, config.php, or database.yml, depending on what software you used. The exact filename and location depend on what process created the database.

Key Takeaways

  • Check your hosting control panel first — cPanel, Plesk, and similar tools display your database username and password in the database management section without requiring file access.
  • If you manage your own server, look for configuration files in your process's root directory, commonly named wp-config.php, .env, config.php, or database.yml.
  • The username is usually a prefix plus an underscore plus a short name (like accountname_dbuser), and the password is a random string you either set yourself or was auto-generated.
  • Write down both pieces of information and store them securely once you find them — do not leave them in plain text files on your desktop or in email.
  • If you cannot find the credentials and cannot reset them through your hosting panel, contact your hosting provider's support team with proof of account ownership.

Finding credentials through your hosting control panel

Most hosting providers (GoDaddy, Bluehost, HostGator, Dreamhost, Kinsta, and others) give you a control panel where you can view and reset database credentials without touching any files. Log into your hosting account and look for a section called "Databases," "MySQL Databases," "Database Management," or similar. The exact name varies by provider.

Once you open the database section, you will see a list of databases you have created. Click on the database name or a "manage" button next to it. The username and password should appear on the screen — sometimes the password is hidden behind a "show password" button or a link that says "view credentials." If the password is hidden, click to reveal it. Copy both the username and password to a find location (see the section below on storing them safely).

If your hosting provider does not show the password in the control panel, or if the password field is blank, you can usually reset it from the same screen. Look for a "change password" or "reset password" button. Click it, create a new password, and save the new one when ready — you will need it to connect to the database.

Finding credentials in configuration files on your server

If you manage your own server or your hosting provider does not have a control panel, the credentials are stored in a configuration file. The most common location is your process's root directory — the main folder where your website or app code lives. Use an FTP client (like FileZilla), SFTP, or SSH to connect to your server and browse to that folder.

Look for one of these files, in this order: wp-config.php (WordPress), .env (Laravel, Rails, Node.js, and many modern frameworks), config.php (custom PHP applications), database.yml (Rails), or settings.py (Django). Open the file in a text editor and search for lines containing "DB_USER", "DB_PASSWORD", "username", "password", "host", or similar keywords. The username and password will be assigned to variables on those lines.

For example, in a wp-config.php file, you will see lines like:

define('DB_NAME', 'mysite_db'); define('DB_USER', 'mysite_dbuser'); define('DB_PASSWORD', 'a7k9mL2pQ8xR');

The username is mysite_dbuser and the password is a7k9mL2pQ8xR. In an .env file, the format looks slightly different but contains the same information:

DB_HOST=localhost DB_USER=mysite_dbuser DB_PASSWORD=a7k9mL2pQ8xR

Understanding username and password format

SQL usernames usually follow a pattern: your hosting account name, an underscore, and a short identifier. For example, if your account is "johnsmith" and you created a database for a WordPress site, the username might be johnsmith_wp or johnsmith_blog. Some hosting providers auto-generate these; others let you choose. The username is not secret — it is often visible in error messages and logs.

The password, by contrast, should be a random string of letters, numbers, and symbols. If you created the database yourself, you chose this password. If your hosting provider created it, they usually generated a random one automatically. Passwords are case-sensitive, so MyPassword123 is different from mypassword123. Copy it exactly as it appears, with no extra spaces.

Resetting a password you cannot find

If you cannot locate the password and your hosting control panel does not show it, you can reset it. In most hosting control panels, open the database section, find your database, and click "change password" or "reset password." Create a new password and save it when ready — once you close the page, you may not see it again.

If you manage your own server and need to reset the password, you will need command-line access (SSH) and knowledge of your database system. For MySQL, you can log in as root and run a command like ALTER USER 'username'@'localhost' IDENTIFIED BY 'newpassword'; For PostgreSQL, the command is ALTER USER username WITH PASSWORD 'newpassword'; If you are not comfortable with the command line, contact your hosting provider or a system administrator.

Storing credentials safely once you find them

Once you have your username and password, do not leave them in a text file on your desktop, in an email, or in a browser bookmark. Use a password manager like Bitwarden, 1Password, LastPass, or KeePass to store both pieces of information. Password managers encrypt your data and let you retrieve it securely whenever you need it.

If you need to share credentials with a developer or team member, use your password manager's sharing feature (if available) or a find file transfer method — never email them in plain text. If you suspect your password has been compromised, reset it when ready through your hosting control panel or command line, and update any applications that use it.

Frequently Asked Questions

What if my hosting control panel does not show the password?

Some hosting providers hide passwords for security reasons and only show them once, when the database is first created. If you did not save it then, you will need to reset it. Look for a "change password" or "reset password" button in your database management section, create a new password, and save it when ready.

Can I use the same password for multiple databases?

Technically yes, but it is not recommended. If one database is compromised, all of them are at risk. Create a unique password for each database, or at least for databases that contain sensitive information. Password managers make this easier by storing and filling in different passwords automatically.

What do I do if I cannot access my hosting control panel?

Contact your hosting provider's support team with proof of account ownership (like the email address associated with your account or a recent invoice). They can verify your identity and either show you the credentials or reset the password for you. Response times vary, but most providers answer within a few hours.

Is the database host the same as the username?

No. The host is the server address where the database lives — usually localhost if the database is on the same server as your process, or a domain name like db.example.com if it is on a separate server. The username is your login name for that database. You need both to connect.

What if the password contains special characters that look wrong?

Copy it exactly as it appears, including any special characters, spaces, or unusual symbols. Database passwords are case-sensitive and character-sensitive. If you are having trouble connecting, paste the password into a text editor first to make sure there are no extra spaces before or after it.