Where SQL Server stores login credentials

SQL Server does not store passwords in plain text anywhere you can read them back. Once you set a password during installation or through SQL Server Management Studio, the server hashes it — converts it into a scrambled form that cannot be reversed. This means you cannot retrieve a password you have forgotten; you can only reset it.

What you can find are the usernames themselves, which SQL Server keeps in its system databases. The most common place to look is the master database, which holds all login accounts for the entire server instance. You can view the list of logins without needing to know their passwords.

If you installed SQL Server yourself on your own machine, you likely chose the authentication method during setup — either Windows Authentication (which uses your Windows account) or Mixed Mode (which allows both Windows accounts and SQL Server logins). Knowing which one you chose will tell you where to look first.

Key Takeaways

  • SQL Server passwords are hashed and cannot be recovered, but usernames are stored in the master database and can be viewed through SQL Server Management Studio.
  • Windows Authentication logins use your Windows username and do not require a separate SQL Server password.
  • SQL Server logins (the kind with a separate username and password) are created and managed through the Security folder in Management Studio.
  • If you have local administrator access on the machine, you can reset a forgotten SQL Server login password by restarting the service in single-user mode.
  • The sa (system administrator) account is the default SQL Server login, but it may be disabled or renamed depending on your installation.

Viewing SQL Server logins in Management Studio

Open SQL Server Management Studio and connect to your server instance. In the Object Explorer panel on the left, expand the server name, then expand the Security folder. Click on Logins to see all SQL Server logins on that instance.

Each login in this list is a username that can connect to SQL Server. The list shows the login name, the authentication type (Windows or SQL Server), and whether the login is enabled or disabled. If you see a login you do not recognize or do not remember creating, this is where you would find it.

Right-click any login name and select Properties to see more details: when it was created, what roles it belongs to, and what databases it can access. This does not show the password, but it shows you what that login is allowed to do on the server.

Finding Windows Authentication logins

If your SQL Server uses Windows Authentication, the usernames are your Windows domain or local computer usernames. These logins do not have separate passwords in SQL Server — they use your Windows password instead.

To find which Windows accounts have access to SQL Server, open Management Studio, go to Security > Logins, and look for entries that say Windows Authentication in the Type column. These will be formatted as COMPUTERNAME\username or DOMAIN\username.

If you are the person who installed SQL Server on your own machine, your Windows account was automatically added as a system administrator during setup. You can connect to SQL Server using your Windows login without needing a separate SQL Server password.

Resetting a forgotten SQL Server login password

If you know the username but have forgotten the password, you can reset it if you have local administrator access to the machine running SQL Server. Right-click the login name in Management Studio, select Properties, go to the General tab, and enter a new password in the Password field. Click OK to save the change.

If you cannot open Management Studio because you do not know any login credentials, you will need to restart SQL Server in single-user mode. This is a more involved process: stop the SQL Server service, restart it with the -m flag from the command line, connect as a Windows administrator, reset the password, then restart the service normally. Microsoft's documentation covers the exact steps for your SQL Server version.

If you do not have local administrator access to the machine, you will need to contact whoever manages that server — a system administrator, hosting provider, or IT department — to reset the password for you.

The default sa account

SQL Server includes a built-in login called sa (system administrator) that has full control over the entire server. During installation, you set a password for this account. If you installed SQL Server yourself, you chose that password.

In newer versions of SQL Server, the sa account is disabled by default for security reasons. If you need to use it, you can enable it through Management Studio: right-click the sa login, select Properties, go to the Status tab, and change Login to Enabled. You can also reset its password from the same Properties window.

If you installed SQL Server in Mixed Mode authentication and do not remember the sa password, you can reset it using the single-user mode process described above. If you installed it in Windows Authentication only, the sa account exists but is disabled, and you would need to enable it first before you can use it.

Checking what databases a login can access

A SQL Server login is permission to connect to the server. What that login can actually do depends on which databases it has been granted access to and what role it holds in each one.

To see which databases a login can use, open Management Studio, go to Security > Logins, right-click the login name, and select Properties. Click the User Mapping tab. This shows every database on the server and whether that login has been mapped to a user in each one. A checkmark means the login can access that database; no checkmark means it cannot.

If a login is mapped to a database, the Database role membership section below shows what that login is allowed to do in that database — whether it is a reader, writer, administrator, or has a custom role. This is useful if you are trying to understand why a login can or cannot perform a certain action.

Finding the login you use to connect

If you are already connected to SQL Server in Management Studio, you can see which login you used. Look at the top of the Object Explorer window — it shows the server name and the login name you connected with, formatted as ServerName (LoginName).

You can also run a SQL query to see the current login. Open a new query window, paste this command, and execute it:

SELECT SYSTEM_USER;

This returns the username of the login currently connected to the server. If you connected using Windows Authentication, it shows your Windows username. If you connected using a SQL Server login, it shows that login name.

Frequently Asked Questions

Can I see the actual password for a SQL Server login?

No. SQL Server hashes passwords when you create them, which means they are converted into a form that cannot be reversed back to the original password. Even the system administrator cannot read a password that has been set. You can only reset a password to a new one if you have the right permissions.

What is the difference between Windows Authentication and SQL Server Authentication?

Windows Authentication uses your Windows username and password to log into SQL Server — you do not need a separate SQL Server password. SQL Server Authentication creates a separate login and password just for SQL Server, independent of your Windows account. Mixed Mode allows both types on the same server.

How do I know if my SQL Server uses Windows or SQL Server Authentication?

Open SQL Server Management Studio and look at the logins under Security > Logins. If you see logins formatted as COMPUTERNAME\username or DOMAIN\username, those are Windows Authentication. If you see logins with just a name (like sa or appuser), those are SQL Server logins. Most servers use both.

What should I do if I see a login I do not recognize?

Right-click the login and check its Properties to see what databases it can access and what role it holds. If it is a leftover account from a previous process or user, you can disable it by right-clicking and selecting Disable, or delete it by selecting Delete. Disabling is safer if you are not sure whether something still needs it.

Can I change a SQL Server login name?

Yes. Right-click the login in Management Studio, select Rename, and type the new name. However, any applications or scripts that connect using the old name will stop working until you update them to use the new name. It is usually safer to create a new login with the new name and disable the old one, giving you time to update everything.