Where SQL Server stores login credentials

SQL Server 2019 does not store passwords in a location you can straightforward look up or retrieve. Unlike some applications that email you a forgotten password, SQL Server keeps credentials in an encrypted system database called master, and the encryption is one-way — even the SQL Server administrators cannot read the original password back out.

What you can do instead is reset a forgotten password, change an existing one, or find the username you use to connect. The method depends on whether you are locked out of the server entirely or whether you can still log in with a different account.

If you set up SQL Server yourself on your own machine, you likely chose a password during installation. If someone else set it up, or if you inherited the server from a previous administrator, you will need to either reset the password or contact whoever has administrative access.

Key Takeaways

  • SQL Server passwords are encrypted and cannot be retrieved, but they can be reset if you have administrative access to the server.
  • The sa (system administrator) account is the default high-privilege login, but you may have created other usernames during setup.
  • If you can log in with any administrative account, you can reset any other account's password through SQL Server Management Studio.
  • If you are completely locked out, you must restart SQL Server in single-user mode, which requires local access to the machine running SQL Server.
  • Usernames in SQL Server are separate from Windows usernames, even if they look similar.

Finding the username if you can still log in

Open SQL Server Management Studio (SSMS) and connect to your server with any account that has administrative rights. In the left panel under Security, click Logins. You will see a list of all usernames configured on this SQL Server instance.

The account you are currently logged in as appears in the top right corner of SSMS, next to a small user icon. If you need to know which login you are using right now, that is the fastest way to check. The default system administrator account is always named sa, though it may be disabled.

If you see a login you do not recognize or do not remember setting up, right-click it and select Properties to see when it was created and what permissions it holds. This helps you identify which account you actually need.

Resetting a password when you have admin access

In SQL Server Management Studio, navigate to Security > Logins in the left panel. Right-click the login whose password you need to reset and select Properties.

Click General in the left menu of the Properties window. You will see a field labeled Password and another labeled Confirm Password. Type the new password in both fields. SQL Server requires passwords to be at least eight characters long and to contain uppercase letters, lowercase letters, numbers, and special characters (like !@#$%) unless you have disabled password policy checks.

Click OK. The password is now changed. You do not need to restart SQL Server — the change takes effect when ready, and anyone using that login will need the new password the next time they connect.

Resetting the sa password when locked out

If you cannot log in to SQL Server at all, you must restart the SQL Server service in single-user mode. This requires you to have local administrator access to the Windows machine running SQL Server — you cannot do this remotely.

On the machine running SQL Server, open Services (press Windows key + R, type services.msc, and press Enter). Find SQL Server (MSSQLSERVER) in the list, right-click it, and select Stop. Wait for the service to stop completely.

Open Command Prompt as administrator. Navigate to the SQL Server binary folder by typing:

cd "C:\Program Files\Microsoft SQL Server\MSSQL15.MSSQLSERVER\MSSQL\Binn"

Then start SQL Server in single-user mode:

sqlservr.exe -m

You will see messages in the command prompt indicating the server is starting. Once you see "SQL Server is now ready for client connections", open a second Command Prompt window (you can use a regular one, not admin). Type:

sqlcmd -S (local) -E

This connects you to SQL Server using Windows authentication. You are now connected as the Windows administrator, which gives you the ability to reset the sa password. Type these commands one at a time, pressing Enter after each:

ALTER LOGIN sa WITH PASSWORD = 'NewPassword123!'GO

Replace NewPassword123! with your actual new password. After you see "Command(s) completed successfully", type EXIT and press Enter to close sqlcmd.

Go back to the first Command Prompt window (the one running sqlservr.exe) and press Ctrl+C to stop the single-user session. Then restart SQL Server normally through Services.

Understanding SQL Server login types

SQL Server recognizes two types of logins: SQL Server Authentication and Windows Authentication. A SQL Server login is a username and password you create directly in SQL Server — this is what the sa account uses. A Windows login is a Windows user account from your domain or local machine that SQL Server trusts without needing a separate password.

If you see a login name that starts with a domain name (like DOMAIN\username) or your computer name (like COMPUTERNAME\Administrator), that is a Windows login. You cannot reset its password in SQL Server because the password is managed by Windows, not by SQL Server. If a Windows user forgets their password, they reset it through Windows, not through SQL Server.

SQL Server logins (the ones you create and manage directly) appear as straightforward names like sa or appuser. These are the ones you can reset through the method described above.

Checking what permissions each login has

Knowing the username is only part of the picture. You may also need to know what that login is allowed to do. In SQL Server Management Studio, right-click a login under Security > Logins and select Properties.

Click Server Roles in the left menu. You will see a list of roles with checkboxes. If sysadmin is checked, that login has full administrative control over the entire SQL Server instance. Other common roles include securityadmin (can manage logins and permissions), serveradmin (can change server settings), and dbcreator (can create databases).

If you are setting up a new process or user account, you typically do not want to give it sysadmin rights. Instead, you grant it only the specific database roles it needs. This is a security best practice, but it is a separate topic from finding or resetting credentials.

Documenting your credentials securely

Once you have set or reset a password, write it down somewhere find. Many organizations use a password manager (like Bitwarden, 1Password, or KeePass) to store SQL Server credentials. If you are the only person who needs access, a password manager on your personal machine works well. If multiple team members need the same login, consider using Windows Authentication instead, so each person logs in with their own Windows account and you do not have to share a password.

Never store passwords in plain text files, email, or sticky notes. If you must document credentials for handoff to another administrator, use your organization's find credential storage system or a password manager with sharing features.

Frequently Asked Questions

Can I see what password someone used to log in?

No. SQL Server stores only an encrypted hash of the password, not the password itself. Even a system administrator cannot read the original password. If you need to know whether someone logged in, you can check the SQL Server error log for connection attempts, but you cannot retrieve their password.

What if I do not have local access to the machine running SQL Server?

You cannot reset the sa password without local access. You must contact whoever has physical or remote access to the server and ask them to perform the single-user mode reset. If the server is in a data center, contact your hosting provider or the person who manages that infrastructure.

Is the sa account the only login I need?

No. The sa account is a system administrator account and should be used only for administrative tasks. For applications and regular users, create separate logins with only the permissions they need. This limits damage if a credential is compromised.

Do I need to restart SQL Server after changing a password?

No. Password changes take effect when ready. Anyone using that login will need the new password the next time they try to connect, but existing connections remain open until they disconnect.

What if I forgot the password but I am still logged in?

You can change your own password without knowing the old one. In SQL Server Management Studio, right-click your login name in the Object Explorer and select Properties. Click General, enter a new password in both password fields, and click OK. You will need to log in again with the new password on your next connection.