How to Reset Your Open WebUI Password: 4 Methods

You forgot your Open WebUI admin password or are locked out. The fix depends on your deployment: reset through Settings if you're logged in, use Docker commands if locked out, use SQLite for local installations, or wipe the database as a last resort. This guide covers all four recovery methods, common mistakes that block resets, and how to set up email password recovery to prevent future lockouts.

Know Your Deployment Type

Before you reset anything, identify which setup you're running. Open WebUI can be deployed three ways, and each has a different recovery path. This decision tree takes 30 seconds but saves you an hour of troubleshooting.

First, ask yourself: Are you running Open WebUI in Docker? Open Docker Desktop or run docker ps in your terminal. If you see an open-webui container listed, you're on the Docker path. Docker is the most common method and what most people use for self-hosting.

If you don't see a Docker container, check whether you installed Open WebUI with pip or another package manager. Open a terminal and type pip show open-webui. If it returns a package location, you have a local pip installation. This is common for development or smaller setups.

Third, are you running Open WebUI on managed hosting? If you signed up with a provider like Opsily, you don't have direct access to the database or Docker commands. Contact your hosting support, or use the password reset option in the web dashboard if available.

The rest of this guide covers Docker, local pip, and database methods. If you're on managed hosting, skip to the "Full Database Reset" section to understand what's happening behind the scenes, then ask your provider for a reset.

Reset Password While Logged In: Quickest Method

If you remember your password or have access to any user account, the fastest reset is through the web interface. This requires no command-line access, no database edits, and works everywhere: Docker, local, or managed hosting.

Log in to Open WebUI with your current password or any account you have access to. Once logged in, click your username or avatar in the top right corner. Select "Settings" or "Account Settings" from the dropdown menu. Look for a "Password" or "Change Password" section.

Enter your current password, then enter a new password twice to confirm. Make it at least 12 characters and mix uppercase, lowercase, numbers, and symbols. Open WebUI uses bcrypt hashing, which is secure, but a strong base password is still critical. Click "Save" or "Update Password."

You'll be logged out automatically. Log back in with your new password. Done. This method works instantly and requires no downtime or container restarts.

The caveat: this method only works if you remember a password for some account. If you're completely locked out or there's no account to access, move to the Docker or SQLite methods below.

Docker: Reset a Forgotten Admin Password

This is the most common scenario: you self-host Open WebUI in Docker, forgot the admin password, and can't log in. The official docs cover this, but the details around bcrypt hashing and shell escaping trip up most users. Here's the step-by-step.

Step 1: Generate a bcrypt password hash.

Open a terminal and run this command:

htpasswd -bnBC 10 "" your-new-password | tr -d ':\n'

Replace your-new-password with your new password. Do not include quotes in the actual command. The output will be a long string starting with $2a$ or $2b$. Copy the entire string.

Example output:

$2b$10$N9qo8uLOickgx2ZMRZoMyeIjZAgcg7b3XeKeUxWdeS86E36P4/LaO

That string is your password hash. Keep it on your clipboard.

Step 2: Connect to the Open WebUI Docker container.

Run:

docker exec -it open-webui sh

This opens a shell inside the container. If your container has a different name, replace open-webui with your container name.

Step 3: Access the SQLite database.

Inside the container, run:

sqlite3 data/webui.db

This opens the SQLite command prompt. You'll see sqlite> as your prompt.

Step 4: Update the password in the database.

At the sqlite> prompt, run:

UPDATE user SET password_hash = '$2b$10$N9qo8uLOickgx2ZMRZoMyeIjZAgcg7b3XeKeUxWdeS86E36P4/LaO' WHERE id = 1;

Replace the hash with the one you generated in Step 1. The id = 1 targets the first admin account. If you have multiple accounts and don't know which is admin, you can check with SELECT id, email, role FROM user; first.

Step 5: Exit and restart.

Type .quit to exit SQLite, then exit to close the container shell. Your container is still running.

Restart the container:

docker restart open-webui

Wait 10 seconds. Then open Open WebUI in your browser and log in with your new password.

The $ escaping gotcha:

If you're running the Docker command on a Mac or Linux machine using bash, and your password hash contains $ characters (which bcrypt hashes always do), you must escape them. Replace each $ with \$ in the docker exec command, or you'll get permission denied errors.

Example: If your hash is $2b$10$N9qo8..., run:

docker exec -it open-webui sh -c 'sqlite3 data/webui.db'

Or use single quotes around the entire hash when updating it in SQLite.

Local Installation: Reset Without Docker

If you installed Open WebUI with pip (not Docker), the reset process is simpler. You access the SQLite database directly without entering a container.

Step 1: Generate the bcrypt hash (same as Docker).

Open a terminal and run:

htpasswd -bnBC 10 "" your-new-password | tr -d ':\n'

Copy the output hash.

Step 2: Find the webui.db file.

Open WebUI stores its database at backend/data/webui.db relative to where you installed it. If you installed it globally with pip, it might be in ~/.local/share/open-webui/data/webui.db or /opt/open-webui/data/webui.db. Run:

find ~ -name webui.db 2>/dev/null

This searches your home directory for the file. It may take 10 seconds.

Step 3: Open SQLite and update the password.

Once you find webui.db, run:

sqlite3 /path/to/webui.db

Replace /path/to/ with your actual path. At the sqlite> prompt:

UPDATE user SET password_hash = '$2b$10$...' WHERE id = 1;

Paste your hash from Step 1.

Step 4: Restart Open WebUI.

Exit SQLite (.quit) and restart Open WebUI. If you're running it as a service:

systemctl restart open-webui

Or, if you started it manually, kill the process and restart it.

Log in with your new password.

Enable Email Password Reset: SMTP Configuration

The official Open WebUI docs don't cover self-service password recovery via email. But you can enable it by configuring SMTP environment variables. This is a gap most self-hosted setups overlook.

When SMTP is configured, Open WebUI will show a "Forgot Password?" link on the login page. Users enter their email, receive a recovery link, and reset their password without admin intervention.

Set these environment variables when starting Open WebUI:

WEBUI_SMTP_HOST=smtp.gmail.com
WEBUI_SMTP_PORT=587
WEBUI_SMTP_SECURITY=tls
WEBUI_SMTP_USERNAME=your-email@gmail.com
WEBUI_SMTP_PASSWORD=your-app-password
WEBUI_SMTP_FROM_NAME=Open WebUI
WEBUI_SMTP_FROM_ADDRESS=your-email@gmail.com

For Docker, add these to your docker-compose.yml or docker run command:

environment:
  WEBUI_SMTP_HOST: smtp.gmail.com
  WEBUI_SMTP_PORT: "587"
  WEBUI_SMTP_SECURITY: tls
  WEBUI_SMTP_USERNAME: your-email@gmail.com
  WEBUI_SMTP_PASSWORD: your-app-password
  WEBUI_SMTP_FROM_NAME: Open WebUI
  WEBUI_SMTP_FROM_ADDRESS: your-email@gmail.com

For local pip installations, set these in your shell before running open-webui:

export WEBUI_SMTP_HOST=smtp.gmail.com
export WEBUI_SMTP_PORT=587
export WEBUI_SMTP_SECURITY=tls
export WEBUI_SMTP_USERNAME=your-email@gmail.com
export WEBUI_SMTP_PASSWORD=your-app-password

Then start Open WebUI as usual.

Using Gmail:

If you're using Gmail, you must generate an app-specific password. Go to myaccount.google.com, select Security, and enable two-factor authentication. Then create an App Password and paste it into WEBUI_SMTP_PASSWORD. Your regular Gmail password won't work.

Using other mail providers:

For Outlook: use smtp.office365.com, port 587, security tls. For SendGrid: use smtp.sendgrid.net, port 587, security tls. For your own mail server: use your server's SMTP hostname and port.

After setting SMTP, restart Open WebUI. The "Forgot Password?" link should appear on the login page. This is the cleanest recovery method for team deployments and prevents lockouts entirely if users save their recovery emails.

Common Mistakes and How to Fix Them

Real users hit these problems. Here's how to avoid or recover from each.

"Invalid data type or bcrypt error"

You pasted a malformed hash. Make sure the hash starts with $2a$ or $2b$ and has no spaces or extra characters. Copy it from the htpasswd command output again, paste it exactly, and retry the SQL update.

"bash: !: event not found"

Your shell interpreted a special character in the password hash. Use single quotes around the hash: '$2b$10$...' in the SQL command, or run the command in sh instead of bash.

"database is locked"

SQLite has a lock on webui.db because Open WebUI is still running. Restart the container or process first, then try again.

"no such table: user"

You opened the wrong database file, or the database is corrupted. Check the path with find again. If webui.db exists but has no tables, the database is corrupt; delete it and restart Open WebUI to regenerate it (you'll lose all accounts).

Permission denied accessing webui.db

The file is owned by root or another user. Run:

sudo chmod 644 /path/to/webui.db

Or run your sqlite3 command with sudo.

"htpasswd: command not found"

htpasswd is part of Apache tools. Install it:

• Ubuntu/Debian: sudo apt-get install apache2-utils
• macOS: brew install httpd
• Windows: Use WSL or generate the hash online (search "bcrypt hash generator" and use the result, but test it first).

Password hash has $ characters but Docker command fails

Escape the $ characters. In the docker exec command, use single quotes or the sh -c syntax to prevent bash expansion.

Full Database Reset: When and How

If all else fails, you can delete webui.db and start fresh. This resets all accounts, settings, and conversation history. Use this only as a last resort.

For Docker:

docker exec -it open-webui rm data/webui.db
docker restart open-webui

For local installations:

rm /path/to/backend/data/webui.db

Then restart Open WebUI.

Open WebUI will recreate a blank database with a default admin account. The first time you start it after deletion, you'll be prompted to create a new admin account or login screen will default to no authentication (depending on your version).

What you lose: All user accounts, passwords, API keys, and conversation history are deleted. This cannot be undone. Back up your webui.db file before attempting any reset if you have data you need to preserve.

Prevent Future Lockouts

The best recovery is prevention. Here are three practical steps.

Use a strong, memorable password: At least 12 characters, mix of uppercase, lowercase, numbers, and symbols. Write it down in a password manager (1Password, Bitwarden, KeePass). Do not rely on memory.

Create a backup admin account: If you're the only admin, create a second user with admin privileges and keep its password separate. Store it in an encrypted note or password manager. If you're locked out of the first account, you can use the backup to reset the primary one.

Enable email password recovery: Set up SMTP as described in Method 4 above. This gives all users self-service recovery and removes the need for admin intervention.

Consider managed hosting: If password resets frustrate you, managed Open WebUI hosting handles recovery automatically. Built-in backups, no Docker commands, no database access needed. For teams, this removes operational burden and ensures someone can always get back in.

Frequently Asked Questions

How do I reset my Open WebUI password if I'm locked out?

Use the Docker method (docker exec + SQLite) if you have container access, or the SQLite local method if you have pip-installed Open WebUI. Both take 5-10 minutes. If neither applies, ask your hosting provider or use the full database reset as a last resort.

What is the htpasswd command for Open WebUI password reset?

Run htpasswd -bnBC 10 "" your-new-password | tr -d ':\n' to generate a bcrypt hash. Copy the output and paste it into the SQL update query. Replace "your-new-password" with your desired password.

How do I find and edit the webui.db file?

For Docker: webui.db is at data/webui.db inside the container. Use docker exec -it open-webui sqlite3 data/webui.db to access it. For local installs: Find it with find ~ -name webui.db 2>/dev/null, then open it with sqlite3 /path/to/webui.db.

Can I reset all user passwords at once in Open WebUI?

There's no bulk password reset command. Deleting webui.db resets all accounts, but you lose all data. For selective resets, log in as admin and use the settings menu to change individual user passwords, or manually update each user's password_hash in the database.

What does "triple-escape $ characters" mean?

Bcrypt hashes contain $ signs. In bash or shell commands, $ triggers variable expansion. To prevent this, wrap the hash in single quotes ('$2b$10$...') or use the sh -c syntax in Docker commands. This tells the shell to treat $ as a literal character.

Why does SQLite say "database is locked"?

Open WebUI is running and has the database file open. Restart the container (docker restart open-webui) or stop the process, then try again.

Can I reset a user's password without deleting their data?

Yes. Use the SQLite method to update only their password_hash in the user table. Their conversations, settings, and API keys remain intact.

The Bottom Line

Password resets in Open WebUI are straightforward once you know which method applies to your setup. If you're logged in, use Settings. If you're locked out in Docker, use the bcrypt + docker exec method. If you have a local installation, use SQLite. Enable SMTP email recovery to give users self-service options and prevent future lockouts. The real lesson: self-hosted tools require backup plans. Strong passwords, backup accounts, and email recovery are your insurance.