> ## Documentation Index
> Fetch the complete documentation index at: https://docs.enterprise.falkordb.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Reset the admin password

> Recover an admin account by resetting the user Secret in Kubernetes.

Because password reset requires a logged-in admin, recovering the admin account is done by resetting the user Secret in Kubernetes.

<Note>
  There is no self-service "forgot password" flow in v1.
</Note>

## How Admin credentials are stored

Local users are stored as Kubernetes Secrets named `falkordb-user-<sanitized-email>` in the admin server namespace. The email is lowercased and any character outside `a-z0-9-` is replaced with `-` (for example `admin@example.com` becomes `falkordb-user-admin-example-com`). Each Secret has a `user` key containing a base64-encoded JSON document with a bcrypt `password` hash.

Note: re-running `helm upgrade` with a new `adminServer.bootstrap.adminUser.password` does **not** reset the password — the chart preserves an existing user Secret. You must patch the Secret directly.

## Reset the password in the Kubernetes Secret

1. Find the admin user Secret:

   ```bash theme={null}
   kubectl -n falkordb-system get secrets -l app.kubernetes.io/component=user
   ```

2. Generate a bcrypt hash for the new password:

   ```bash theme={null}
   htpasswd -bnBC 10 "" 'NewTempPassword123!' | tr -d ':\n'
   ```

   Or with Node.js:

   ```bash theme={null}
   node -e "console.log(require('bcryptjs').hashSync(process.argv[1], 10))" 'NewTempPassword123!'
   ```

3. Patch the `user` JSON in the Secret with the new hash and force a password change on next login:

   ```bash theme={null}
   SECRET=falkordb-user-admin-example-com
   NS=falkordb-system
   HASH='$2y$10$...'

   kubectl -n "$NS" get secret "$SECRET" -o jsonpath='{.data.user}' | base64 -d \
     | jq --arg hash "$HASH" '.password = $hash | .mustChangePassword = true | .updatedAt = (now | todate)' \
     | base64 \
     | xargs -I{} kubectl -n "$NS" patch secret "$SECRET" -p '{"data":{"user":"{}"}}'
   ```

4. Log in with the new password. You are prompted to change it immediately (`mustChangePassword` is set).

If local logins are disabled (`DISABLE_LOCAL_AUTH=true` on the admin server), re-enable local auth temporarily via `adminServer.env` before resetting, then disable it again afterwards.

## Resetting other users' passwords

If an admin **can** log in, reset other users' passwords through the product instead of touching Secrets:

* **Admin UI**: open **Users**, select the user, select **Reset Password**, and share the temporary password through a secure channel. Requires `users:update` permission.

* **CLI**:

  ```bash theme={null}
  falkordb-admin users reset-password user@example.com
  ```

* **API**:

  ```bash theme={null}
  curl -f -X POST "http://localhost:3000/api/users/user%40example.com/reset-password" \
  	-H 'Content-Type: application/json' \
  	-b cookies.txt \
  	-d '{}'
  ```

In all cases the server generates a random temporary password, sets `mustChangePassword: true`, and returns it in the response:

```json theme={null}
{
  "message": "Password reset successfully",
  "tempPassword": "<generated>"
}
```

## Notes

* Resets performed through the API are recorded in the audit log as `user.password_change`. Direct Secret edits are not audited, so record them in your change management process.
* Bootstrap values reference: `adminServer.bootstrap.adminUser.*` in [Helm values](/reference/helm-values).