Generate a Drupal Password Hash — Free Drupal 7 Format Generator

How to Apply Your Generated Password Hash in Drupal — SQL, Drush, and Script Methods

Once you use this drupal password hash generator to create a value, you have three primary paths to apply it: a direct SQL query against the user table (updating the database password field), a Drush command from the terminal, or a bootstrap script using web development framework APIs. Each method suits a different scenario — choose based on what CLI access or remote environment access you have available.

Updating the Hash Directly in the Data Store — SQL Against the users_field_data Table

The most direct method for recovering a locked-out administrator account is a query targeting uid=1. This approach works across every version and requires only data store access — no host-side runtime is needed.

1. Generate the hash: Enter your desired newpassword in the tool above, select your version (Legacy for the v1.0 – v7 era or New Hash for v8/9/10), and copy the full output string produced.
2. Back up your data store: Before modifying the user table directly, always export a full backup. A corrupted pass field will prevent all logins, so this is non-negotiable.
3. Run the SQL UPDATE: Connect using phpMyAdmin, MySQL Workbench, or a direct MySQL CLI session and run the following update query:

update users set name='admin', pass='pasted_big_hash_from_above' where uid=1;

For v8, v9, and v10 installations, the user data is split across two tables. You must also update the users_field_data table in addition to the base users table:

UPDATE users_field_data SET pass='pasted_big_hash_from_above' WHERE uid=1;

After running the query, clear the cache entity table to ensure the system reads the updated credentials rather than a stale cached version. The user identifier for the primary administrator account is always uid=1, making this a reliable target for credential recovery across all installations.

Alternative Methods Using Drush Commands and the password-hash.sh Script

If you have terminal access to your host, the Drush utility provides the fastest path to reset credentials without touching the data store directly. The drush upwd command handles both the hash generation and the table update in a single operation:

drush upwd admin --password="newpassword"

This command works for both the v1.0 – v7 era and modern releases. It internally calls user_hash_password(), applies the correct random prefix, and writes the result directly to the users table — removing the need to manually copy or paste values. It is the recommended approach whenever Drush is installed and available in your environment.

For the v7 era specifically, the scripts folder of your root directory contains the legacy password-hash.sh script. You can invoke this script directly from the terminal to generate a compatible drupal 7 password hash for any plain text input:

cd <drupal root directory>
php scripts/password-hash.sh 'myPassword'

The password-hash.sh utility loads includes/bootstrap.inc and the password include file, calls the internal crypt function with the SHA-512 algorithm and the output of the salt generator, and prints the resulting string to stdout. You then copy that output and paste it into your SQL UPDATE statement. This scripted approach is ideal when Drush is not installed but you still have scripting access on the host.

For v10 environments where you need to generate a new random prefix string, use the following terminal evaluation command:

drush eval "echo Drupal\Component\Utility\Crypt::randomBytesBase64(55) . PHP_EOL"

This invocation calls the Drupal\Component\Utility\Crypt utility (specifically crypt::randomBytesBase64) to produce 55 random bytes encoded as base64, giving you a new random string of sufficient entropy. Copy the output and paste it as the value of $settings['hash_salt'] in your settings.php file. The randombytesBase64 method generates cryptographically secure random bytes — the same source of entropy used during the original installation — so each string is unique and unpredictable. This is the recommended method for generating a new hash_salt in any v9 or v10 environment.

The terminal evaluation approach uses the drupal_component namespace and its utility crypt class, which supersedes the older bootstrap pattern from the v7 era. In modern releases, you no longer need to manually call the bootstrap configuration constant — the CLI tool handles that step automatically.

Programmatic Hashing with Bootstrap — For Bulk User Imports and Custom Scripts

When integrating user management with a third-party application — such as a VB.NET system, a RESTful service endpoint migration pipeline, or a custom user registration script — you need to produce encrypted results outside of the normal web request cycle. The bootstrap approach used in web development lets any script call the native password function without a full web request. For the v7 era, the pattern using the bootstrap include file and password include looks like this:

chdir("/path/to/drupal");
require_once './includes/bootstrap.inc';
drupal_bootstrap(DRUPAL_BOOTSTRAP_CONFIGURATION);
user_hash_password($password);

For more surgical use — for example, a lightweight endpoint that accepts a password via GET and returns its output without triggering a full framework bootstrap — the following snippet (sometimes used in password implementation tooling) isolates just the credential-encoding logic via the password include file:

<?php
if (isset($_GET['p'])) {
  require_once dirname(__FILE__) . '/includes/bootstrap.inc';
  require_once dirname(__FILE__) . '/includes/password.inc';
  print _password_crypt('sha512', $_GET[&#39;p&#39;], _password_generate_salt(DRUPAL_HASH_COUNT));
  exit();
}
print "No password to hash.";

This script calls the internal crypt function directly with the SHA-512 algorithm and uses the salt generator to produce the per-password random string. The output is a salted result in the platform's own phpass-derived format — ready to be inserted into the pass column of the users table. Note that this pattern uses the bootstrap include file (loaded via require_once) to load the platform's constants, including the hash count constant, before calling the credential function. This is a clean way to perform bulk encoding without bootstrapping the full framework.

For bulk user import scenarios, you can either pre-generate values using this online tool and store them in a CSV or JSON payload, or use the bootstrap snippet above inside a migration script. In either case, the pass field written to the data store must contain the full output — including the algorithm prefix and iteration prefix characters — not a raw digest string. A third-party application that writes only a bare digest will cause authentication failures because the validation logic reads the prefix characters to determine how many iterations to apply during credential checking. The service interface or REST-based approach (using the platform's Services or JSON:API modules) is preferable for user register operations when you have the option, as it delegates hash generation and random string generation to the platform itself.

Note: Always treat your settings.php file and the hash_salt value it contains as highly sensitive configuration. Exposing your site's random prefix string gives attackers the information they need to pre-compute candidate passwords specific to your installation. Store the settings file outside the web root where possible, and restrict host file permissions so that only the web process user can read it. The random prefix setting is the cornerstone of your site's authentication integrity — protect it accordingly.

Whether you are a backend developer in web development building an integration, a site administrator recovering access to the administrator account, or a DevOps engineer scripting user accounts through a third-party application, understanding the full credential implementation — from the md5-era approach through the iterative SHA-512 encoding of the drupal 7 password hash scheme to the site-wide hash_salt model of v8 and beyond — gives you the context to use this tool correctly and maintain the highest standards of password management and authentication across your entire ecosystem.