Where SQL Server stores login credentials

SQL Server does not store passwords in a way you can read back out. When you create a login, SQL Server hashes the password — converts it into a scrambled code that cannot be reversed. This is intentional security: even someone with access to the server's internal files cannot see what your actual password is.

What you can do instead is reset a password to something new, or confirm that a username exists. You cannot retrieve a forgotten password, but you can change it if you have the right access level on the server.

Key Takeaways

  • SQL Server passwords are hashed and cannot be read back, so you must reset a password rather than retrieve it.
  • You can view all login names by connecting to SQL Server with an account that has administrative rights and running a straightforward query.
  • Resetting a password requires you to be logged in as a system administrator or someone with ALTER LOGIN permission.
  • If you are locked out entirely, you may need to restart SQL Server in single-user mode, which requires local access to the server computer.

Viewing all usernames on your SQL Server

Open SQL Server Management Studio on a computer that can reach your SQL Server. Connect using an account that has administrative rights — typically the sa account (system administrator) or a Windows account that belongs to the sysadmin server role.

Once connected, open a new query window. Copy and paste this command:

SELECT name FROM sys.sql_logins;

Run the query. You will see a list of all SQL Server logins on that instance. This shows you the usernames that exist, but not the passwords — those remain hashed and invisible.

If you need to see more detail about each login — such as when it was created or whether it is currently locked — use this query instead:

SELECT name, create_date, modify_date, is_disabled FROM sys.sql_logins;

Resetting a password you have forgotten

If you know the username but have forgotten the password, you can reset it. Connect to SQL Server as an administrator, open a new query, and run this command, replacing username with the actual login name and newpassword with what you want the new password to be:

ALTER LOGIN [username] WITH PASSWORD = 'newpassword';

The password takes effect when ready. The person who uses that login can now connect using the new password.

If the password contains special characters like single quotes or backslashes, you may need to escape them. The safest approach is to wrap the password in single quotes and replace any single quote inside the password with two single quotes. For example, if your new password is Pass'word, the command becomes:

ALTER LOGIN [username] WITH PASSWORD = 'Pass''word';

Checking if a specific username exists

To search for one particular username without listing all of them, use this query, replacing username with the name you are looking for:

SELECT name FROM sys.sql_logins WHERE name = 'username';

If the query returns a row with that name, the login exists. If it returns no rows, that username does not exist on this SQL Server instance.

You can also search for usernames that contain part of a name. This query finds any login with "admin" in the name:

SELECT name FROM sys.sql_logins WHERE name LIKE '%admin%';

What to do if you cannot connect at all

If you are locked out of SQL Server entirely and cannot log in as any administrator, you have one option: restart SQL Server in single-user mode. This requires local access to the server computer itself — you cannot do this remotely.

On Windows, open Services (press Windows key + R, type services.msc, and press Enter). Find SQL Server in the list. Right-click it and select Properties. In the "Start parameters" field, add -m on a new line. Click OK and restart the service.

SQL Server will now start in single-user mode, and only one connection is allowed. Connect using Windows authentication with a local administrator account. Once connected, you can reset the sa password or any other login. After you are done, remove the -m parameter and restart the service again to return to normal mode.

Understanding SQL Server authentication modes

SQL Server supports two authentication modes: Windows authentication and SQL Server authentication. The mode affects which usernames you can use and how passwords work.

In Windows authentication mode, you log in using your Windows domain account or local computer account. SQL Server trusts Windows to verify your identity, so there is no separate SQL Server password.

In SQL Server authentication mode, you create logins directly in SQL Server with usernames and passwords that SQL Server manages. The sa account is a SQL Server login, not a Windows account.

You can check which mode is active by connecting to SQL Server and running this query:

SELECT SERVERPROPERTY('IsIntegratedSecurityOnly') AS AuthMode;

A result of 1 means Windows authentication only. A result of 0 means SQL Server authentication is enabled (mixed mode).

Frequently Asked Questions

Can I see the actual password if I have administrator access?

No. SQL Server hashes passwords using a one-way algorithm, so even administrators cannot read them back. You can only reset a password to a new value that you choose.

What is the default sa password when SQL Server is first installed?

SQL Server does not set a default sa password. During installation, you either set one yourself or disable the sa account. If you set one and forgot it, you must restart SQL Server in single-user mode to reset it.

Can I reset a password if I am not a system administrator?

Only if someone has granted you the ALTER LOGIN permission on that specific login. Most organizations restrict this to system administrators. Ask your database administrator if you need a password reset.

What happens if I run the ALTER LOGIN command with a blank password?

SQL Server will reject it. Passwords must meet the complexity requirements set on your server — usually at least eight characters with uppercase, lowercase, numbers, and symbols. Check your password policy before you reset.

Do I need to restart SQL Server after changing a password?

No. The password change takes effect when ready. Anyone currently logged in with that account stays connected, but the next time they disconnect and reconnect, they must use the new password.