Reset Redmine admin password and default login

A fresh Redmine install signs in with admin / admin. Since Redmine 3.3 it makes you change that password right after the first login.

If you forgot the admin password, run this on the server, in the Redmine directory (the one with config/database.yml):

cd /path/to/redmine
RAILS_ENV=production bundle exec rails runner '
  u = User.find_by_login("admin")
  u.password = u.password_confirmation = "NewPass-2026!"
  u.admin = true
  u.status = User::STATUS_ACTIVE
  u.save!
  puts "#{u.login}: password changed, admin=#{u.admin}"
'

It sets a new password, grants admin rights and unlocks the account. Put another login instead of admin to make that user an administrator. Redmine hashes the password itself, so you don't edit the database by hand. I ran it on Redmine 5.1, 6.1 and 7.0 and on a Bitnami 6.0 image.

Redmine default login and password

• Package from redmine.org or the official redmine Docker image: admin / admin.
• Bitnami VM or cloud image: login user, the password is in /home/bitnami/bitnami_credentials (read it with sudo cat). On AWS Lightsail: cat $HOME/bitnami_application_password.
• Bitnami Docker image: user / bitnami1 in the Debian-based images that used to be bitnami/redmine and now live in bitnamilegacy/redmine. In Bitnami Secure Images the login also defaults to user, and the password is whatever you set in REDMINE_PASSWORD.

If the default doesn't work, someone has already changed it. Reset it with the command above.

Rails console alternative

The same steps one by one, handy when you want to look around first:

cd /path/to/redmine
RAILS_ENV=production bundle exec rails console

# who the admins are
User.where(admin: true).pluck(:login)

u = User.find_by_login("admin")
u.password = u.password_confirmation = "NewPass-2026!"
u.admin = true
u.status = User::STATUS_ACTIVE
u.save!

# returns the user if the password works
User.try_to_login("admin", "NewPass-2026!")

Leave the console with exit.

Make a Redmine user an admin

If you can sign in as another admin, go to Administration → Users, click the user's login, tick "Administrator" and click "Save".

If no admin can sign in, run the command from the top of this post with that user's login instead of admin. If rails runner won't start, grant the rights in the database. The query runs as is in MySQL and PostgreSQL; put the user's login instead of jsmith:

UPDATE users SET admin = true WHERE login = 'jsmith';

How to connect to the database is covered below, in the SQL section.

Reset the password on Bitnami Redmine

Current Bitnami VMs and cloud images keep Redmine in /opt/bitnami/redmine, and the admin login there is user, not admin:

cd /opt/bitnami/redmine
RAILS_ENV=production bundle exec rails runner 'u = User.find_by_login("user"); u.password = u.password_confirmation = "NewPass-2026!"; u.admin = true; u.status = User::STATUS_ACTIVE; u.save!'

Older stacks, like the one I ran in 2017 with Redmine 3.x, keep the app in apps/redmine/htdocs inside the stack directory and bring their own Ruby. Load its environment first, then run the same command:

# the installer version lives in /opt/redmine-<version>
cd /opt/bitnami
./use_redmine
cd apps/redmine/htdocs

More on that layout in installing and configuring Bitnami Redmine and installing plugins.

Redmine in Docker

Official redmine image: the working directory and RAILS_ENV=production are already set, so with a container named redmine:

docker exec redmine bundle exec rails runner 'u = User.find_by_login("admin"); u.password = u.password_confirmation = "NewPass-2026!"; u.admin = true; u.status = User::STATUS_ACTIVE; u.save!'

Bitnami image: the app is in /opt/bitnami/redmine:

docker exec -w /opt/bitnami/redmine redmine bundle exec rails runner -e production 'u = User.find_by_login("user"); u.password = u.password_confirmation = "NewPass-2026!"; u.admin = true; u.status = User::STATUS_ACTIVE; u.save!'

The Bitnami image prints the rails new help after the command finishes. That's noise from its bin/rails stub; the password is already saved. Changing REDMINE_PASSWORD later won't help either: the image reads it only on first start.

Reset the Redmine password via SQL

Use this when Ruby on the server is broken and the runner won't start. The database name, user and password are in config/database.yml, section production:

mysql -u redmine -p redmine            # MySQL or MariaDB
psql -U redmine -h localhost redmine   # PostgreSQL

That's how it looked on my Bitnami server back then, the database was called bitnami_redmine:

Find the account. The users table also holds groups and the anonymous user, hence the type filter. status is 1 for active, 2 for registered, 3 for locked:

SELECT id, login, admin, status FROM users WHERE type = 'User';

Set the password to password, unlock the account and make Redmine ask for a new password at the next login:

UPDATE users
SET hashed_password = '353e8061f2befecb6818ba0c034c632fb0bcae1b',
    salt = '',
    status = 1,
    must_change_passwd = true
WHERE login = 'admin';

The query runs as is in MySQL and PostgreSQL. To make another user an admin, add admin = true to the SET and put their login in WHERE.

Why the password is "password"

Redmine compares hashed_password with SHA1(salt + SHA1(password)), see check_password? in app/models/user.rb. With an empty salt that's SHA1(SHA1(password)), and 353e8061… is exactly SHA1(SHA1("password")). Once you change the password in the UI, Redmine generates a fresh random salt.

To set your own password, MySQL and MariaDB compute the hash in place:

UPDATE users
SET hashed_password = SHA1(SHA1('My-own-Pass_2026')), salt = '', status = 1
WHERE login = 'admin';

PostgreSQL has no built-in SHA1, so compute the hash in the shell and paste it into the UPDATE. On macOS use shasum instead of sha1sum:

printf '%s' 'My-own-Pass_2026' | sha1sum | cut -c1-40 | tr -d '\n' | sha1sum | cut -c1-40

Forgot your Redmine password as a regular user

Click "Lost password" on the login page: Redmine emails a reset link if the admin left that option on and email delivery works. Otherwise ask an admin to set a new password in Administration → Users.

When the reset doesn't work

• undefined method 'password_confirmation=' for nil (older Ruby: undefined method `password_confirmation=' for nil:NilClass): there's no user with that login. List them with User.pluck(:login).
• Validation failed: Password is too short (minimum is 8 characters): the new password has to pass the rules in Administration → Settings → Authentication.
• Login still fails: the account may sign in through LDAP, and then Redmine checks the password there. Add u.auth_source = nil before u.save! to switch it to a local password.
• Redmine 4.2+ asks for a two-factor code from a lost phone: add Redmine::Twofa.for_user(u)&.destroy_pairing_without_verify! before u.save!.
• Without RAILS_ENV=production, Rails starts in development mode: it either fails to boot or opens the development database instead of yours.
• Redmine emails all admins a security notice when someone gets admin rights. That's expected.