p24-infra Docs

n8n-user-password-reset

2 min read

Playbook: n8n User Account Password Reset

Status: VERIFIED (2026-07-07)

Trigger

Admin needs to reset an n8n user account password — forgotten password, locked account, or emergency access restoration.

Context

n8n on bms-4 uses PostgreSQL (bms-4-n8n-postgres-1). Passwords are stored as bcrypt hashes (10 rounds) in the public.user table, column password.

n8n container: bms-4-n8n-1 Postgres container: bms-4-n8n-postgres-1 n8n compose dir: /opt/p24-infra/bms-4/

Confirm — check user exists

ssh -i ~/.ssh/id_ed25519 root@54.36.123.110 \
  "docker exec bms-4-n8n-postgres-1 psql -U n8n -d n8n -tAc \
  \"SELECT id, email, role FROM \\\"user\\\" WHERE email='radieu@gmail.com';\""

Expected: one row with the user id and role.

Fix — reset password

  1. Generate bcrypt hash on the server (Python 3 + bcrypt available):
ssh -i ~/.ssh/id_ed25519 root@54.36.123.110 bash -s <<'REMOTE'
NEW_HASH=$(python3 -c "import bcrypt; print(bcrypt.hashpw(b'THE_NEW_PASSWORD', bcrypt.gensalt(10)).decode())")
docker exec bms-4-n8n-postgres-1 psql -U n8n -d n8n -c \
  "UPDATE \"user\" SET password='${NEW_HASH}' WHERE email='radieu@gmail.com';"
REMOTE

Replace THE_NEW_PASSWORD with the new password (never log the value).

  1. Verify the update (row count = 1):
ssh -i ~/.ssh/id_ed25519 root@54.36.123.110 \
  "docker exec bms-4-n8n-postgres-1 psql -U n8n -d n8n -tAc \
  \"SELECT email FROM \\\"user\\\" WHERE email='radieu@gmail.com';\""
  1. No n8n restart needed — password is read fresh on each login.

Alternative — use n8n CLI (if bcrypt module unavailable)

ssh root@54.36.123.110 \
  "docker exec bms-4-n8n-1 node -e \
  \"const b=require('bcryptjs');console.log(b.hashSync('THE_NEW_PASSWORD',10));\""

Pipe the output into the UPDATE query above.

Notes

  • n8n does NOT need to be restarted after a password change
  • The user must change the password on first login
  • mfaEnabled flag in the user table — if MFA was set, the user must re-enroll after reset
  • If the user has mfaEnabled=true, also run: UPDATE "user" SET "mfaEnabled"=false, "mfaSecret"=null, "mfaRecoveryCodes"='[]' WHERE email='...'
  • docs/playbooks/n8n/n8n-db-password-rotation.md — Postgres DB user password (different from n8n account)
  • secrets/n8n-bms4.env.sops — n8n app credentials

Graph View

Backlinks