Identify the account and the problem first
Use this guide for a Joomla website you own or are authorised to administer. A site-user password, a Super User account, a hosting login and an email password belong to different systems. Resetting one does not recover the others.
Record the Joomla version, which login fails and whether another authorised administrator can still sign in. An unavailable login page or a server error may need hosting investigation rather than a password change. Never send a recovery code or password to someone offering unsolicited support.
A site user who can receive email
Where the website exposes a login form, use its forgotten-password link and enter the email address associated with your account. Complete the verification and new-password steps supplied by the site. A username reminder is a separate option where enabled.
If the message does not arrive, check spam folders, the address used and any expired request. A site administrator can investigate delivery using the Joomla SMTP guide. Avoid sending repeated requests while the mail configuration remains broken.
This front-end route is not a universal recovery method for every administrator account. Use the appropriate administrative route when normal self-service recovery is unavailable.
Another authorised administrator can sign in
Ask an administrator with the necessary user-management permissions to identify the correct account in Users → Manage. They can open its edit screen, set an interim password and use Require Password Reset so the account owner chooses a new password after signing in.
Verify the requester’s identity before changing an account. Share any interim credential through an agreed secure channel, use a unique value and do not put it into a public support ticket. Test the intended login afterwards; do not change group membership simply to work around a password problem.
The only Super User is locked out
Take a recoverable files-and-database backup before editing the installation. Confirm that your hosting access points to the correct site and database, especially on accounts holding several sites.
Joomla documents a temporary root_user recovery option for someone who can already sign in as an authorised Manager or Administrator. It also documents database recovery when that route is unavailable. Follow the official administrator recovery procedure for your installation rather than pasting a generic SQL statement or publicly known password hash into a production database.
Temporary elevated access must be removed immediately after recovery. A database-table prefix is site-specific, and editing the wrong user or installation can make matters worse. If you cannot establish the correct account, use the site’s administrator or hosting support before making changes.
Password recovery and MFA are separate
A new password does not replace a missing second factor. Use the recovery methods established for your account and consult Joomla’s multi-factor authentication documentation. Do not disable authentication plugins across the site merely to solve one user’s problem.
Check the account after recovery
Choose a unique password, review the recovery email and confirm your MFA and backup-code arrangements. Remove temporary recovery changes and review unexpected user accounts or changes. If access was lost through suspected compromise, follow the security and recovery guidance rather than treating a password reset as a complete repair.
Sources: Joomla’s user password reset, administrator recovery and MFA documentation. Menu labels and recovery options vary by version and configuration; this walkthrough has not been validated against a live installation.