Reset the Magento 2 Admin Password and Fix a 2FA Lockout from the CLI

First, work out which lockout you actually have

The two failure modes look similar from the login screen but need different fixes, so name yours before touching anything:

• Forgotten or wrong password. The login form rejects your credentials, or the "forgot password" email never arrives because outbound mail is not configured on this box. Fix: reset the password (next two sections).
• Account locked. Magento locked the user after repeated failed attempts. The message mentions the account being disabled or locked even when you type the right password. Fix: clear the failure counter.
• 2FA rejects every code. Password is accepted, then the authenticator step fails. New phone, deleted authenticator entry, or (most often) the server clock has drifted. Fix: reset the user's 2FA provider, or fix the clock.

You need shell access as a user that can run bin/magento and, for the database steps, MySQL credentials from app/etc/env.php. Everything below runs on the server, not in the browser.

Reset the admin password with admin:user:create

The cleanest supported route is the account creation command. Magento treats admin:user:create as an upsert: run it with a username that already exists and it updates that record, including the password, rather than erroring out. All five flags are required:

cd /var/www/html
php bin/magento admin:user:create \
  --admin-user='admin' \
  --admin-password='Str0ngP4ss!word' \
  --admin-email='you@example.com' \
  --admin-firstname='Site' \
  --admin-lastname='Admin'

Use the exact existing username for --admin-user and keep the same --admin-email the account already has, otherwise you can end up with a second admin instead of updating the first. The command writes the password through Magento's own encryptor, so the stored hash always matches the version and salt scheme your release expects.

If the command rejects your password, it is the policy, not a bug. Magento's admin password rules are:

• Minimum length of 7 characters (config path admin/security/minimum_password_length).
• At least 3 of the 4 character classes: lowercase, uppercase, digits, special characters (admin/security/password_min_length requires 3 by default).
• It must differ from the account's recent passwords. Magento keeps a history and refuses reuse, so append something new rather than retyping the old one you half remember.

After it succeeds, flush the cache (covered at the end) and log in. This is the route to reach for first because it never touches raw SQL.

Reset the password directly in the database, the right way

Sometimes the CLI is not available for the password path (broken DI compilation, a half-migrated release) and you need to write the hash yourself. Do not do this with a hash you found in a forum post or generated with a random md5(). Magento stores admin passwords with a versioned scheme (algorithm plus salt encoded into the string), and a hash built any other way will be rejected at login even though the row looks fine.

The correct approach is a tiny bootstrap script that asks Magento to build the hash for you through Magento\Framework\Encryption\EncryptorInterface::getHash(). The second argument true tells it to generate a fresh salt using the current scheme, so the result is byte-for-byte what Magento would have written itself. Drop this in var/ as a throwaway (no module or namespace needed):

<?php
// var/reset-admin.php  --  DELETE THIS FILE AFTER USE
use Magento\Framework\App\Bootstrap;

require __DIR__ . '/../app/bootstrap.php';

$bootstrap = Bootstrap::create(BP, $_SERVER);
$om = $bootstrap->getObjectManager();

// Load the adminhtml area so admin config resolves correctly.
$om->get(\Magento\Framework\App\State::class)->setAreaCode('adminhtml');

$username    = 'admin';
$newPassword = 'Str0ngP4ss!word';

$encryptor = $om->get(\Magento\Framework\Encryption\EncryptorInterface::class);
$hash      = $encryptor->getHash($newPassword, true); // true = new salt, current version

$resource   = $om->get(\Magento\Framework\App\ResourceConnection::class);
$connection = $resource->getConnection();
$table      = $resource->getTableName('admin_user');

$connection->update(
    $table,
    ['password' => $hash, 'failures_num' => 0, 'lock_expires' => null],
    ['username = ?' => $username]
);

echo "Password updated for {$username}\n";

Run it once as the web user, confirm the message, then delete it immediately:

php var/reset-admin.php
rm var/reset-admin.php

Notice the script also clears failures_num and lock_expires in the same update, so it doubles as an unlock. If you truly must run bare SQL, at least never invent the password column value by hand.

Unlock an account locked by failed logins

Magento locks an admin after a configurable number of failed attempts (default 6) to blunt brute-force attacks. Once locked, even the correct password bounces until the lock expires or you clear it. The CLI way:

php bin/magento admin:user:unlock admin

If the CLI cannot run, the same two columns clear the lock directly. Connect with the magento user and database name from app/etc/env.php:

UPDATE admin_user
SET failures_num = 0, lock_expires = NULL
WHERE username = 'admin';

That resets the counter and removes the lock timestamp. It does not change the password, so if you are locked out because you also forgot the password, combine this with one of the reset steps above.

Fix the 2FA lockout

Magento has forced two-factor authentication on the admin since 2.4.0, and Adobe Commerce adds its own module on top. That is a good default, but it means a lost authenticator app, a wiped phone, or a mistyped seed leaves you stuck at the OTP step with a valid password. To reset the configured provider for one user so they can enroll again:

php bin/magento security:tfa:reset admin google

The first argument is the username, the second is the provider code. The built-in providers are:

• google (Google Authenticator, the default TOTP app)
• duo_security (Duo)
• authy (Twilio Authy)
• u2fkey (U2F hardware keys such as YubiKey)

After the reset, that user's stored 2FA configuration is cleared. On their next admin login Magento walks them through enrollment again: new QR code, new secret, a clean start. If you are not sure which provider was active, resetting google covers the overwhelmingly common case.

Before you reset anything, check the server clock

Here is the part most guides skip. TOTP codes (the six digits from Google Authenticator) are derived from the current time in 30-second windows. If the server clock has drifted more than about a minute from real time, every code the user types is "wrong" even though their phone is perfect. This is the single most common cause of a sudden 2FA lockout where nothing on the user's side changed. Check it first:

# On the host
timedatectl status
# Look for: "System clock synchronized: yes" and "NTP service: active"

# Turn NTP sync back on if it drifted
sudo timedatectl set-ntp true

If Magento runs in Docker, the clock that matters is inside the PHP container, and containers can drift independently of the host. Check it directly:

docker exec kishansavaliya_php date
# Compare against the host:
date

If those two differ by more than a few seconds, fix the container's time source and restart it before you go resetting 2FA seeds. Correcting the clock often makes the "broken" authenticator start working again with no reset at all.

Emergency only: temporarily disabling the 2FA module

If you are completely shut out (no working authenticator and the reset command is not an option for some reason), you can disable the module to get in, then turn it straight back on:

# Get in
php bin/magento module:disable Magento_TwoFactorAuth
php bin/magento cache:flush

# ... log in, sort out the real issue ...

# Turn it back ON immediately
php bin/magento module:enable Magento_TwoFactorAuth
php bin/magento setup:upgrade
php bin/magento cache:flush

On Adobe Commerce you may also see Magento_AdminAdobeImsTwoFactorAuth in the mix; the same enable/disable pattern applies.

Regain access, then re-login

Whichever route you took, flush the cache so Magento picks up the changed user record, module state, or config:

php bin/magento cache:flush

Then open the admin URL and log in with the new password. If you reset 2FA, expect the enrollment screen instead of the usual OTP prompt. If the login page itself renders blank rather than accepting credentials, that is a different class of problem: walk through the Magento 2 blank page fix guide, which covers the admin-only blank caused by 2FA and Adobe IMS modules. Once you are in, rotate any credentials that may have leaked while the account was in an unknown state, and confirm 2FA is enabled again.