> ## Documentation Index
> Fetch the complete documentation index at: https://docs.falkordb.com/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> FalkorDB is a graph database that speaks the Redis protocol. Queries are issued as OpenCypher through the GRAPH.QUERY and GRAPH.RO_QUERY commands, not over Bolt or a SQL connection.
> FalkorDB implements a subset of OpenCypher with proprietary extensions. Do not assume Neo4j-only syntax or procedures are available — check /cypher/cypher-support and /cypher/known-limitations before using a clause.
> FalkorDB is the successor to RedisGraph, but they are separate products. Do not present RedisGraph commands, versions, or limitations as current FalkorDB behavior.
> Use the official clients listed in /getting-started/clients rather than generic Redis or Neo4j drivers, and prefer the language the user is already working in.
> Configuration parameters are set with GRAPH.CONFIG SET or at startup; cite the exact parameter name from /getting-started/configuration rather than inventing one.
> This site covers four products: FalkorDB (core), FalkorDB Cloud, FalkorDB Enterprise, and the GraphRAG SDK. Name which one an answer applies to, since setup and operations differ.

# Reset the admin password

> Recover an admin account by resetting the user Secret in Kubernetes.

Because password reset requires a logged-in admin, recovering the admin account is done by resetting the user Secret in Kubernetes.

<Note>
  There is no self-service "forgot password" flow in v1.
</Note>

## How Admin credentials are stored

Local users are stored as Kubernetes Secrets named `falkordb-user-<sanitized-email>` in the admin server namespace. The email is lowercased and any character outside `a-z0-9-` is replaced with `-` (for example `admin@example.com` becomes `falkordb-user-admin-example-com`). Each Secret has a `user` key containing a base64-encoded JSON document with a bcrypt `password` hash.

Note: re-running `helm upgrade` with a new `adminServer.bootstrap.adminUser.password` does **not** reset the password — the chart preserves an existing user Secret. You must patch the Secret directly.

## Reset the password in the Kubernetes Secret

1. Find the admin user Secret:

   ```bash theme={null}
   kubectl -n falkordb-system get secrets -l app.kubernetes.io/component=user
   ```

2. Generate a bcrypt hash for the new password:

   ```bash theme={null}
   htpasswd -bnBC 10 "" 'NewTempPassword123!' | tr -d ':\n'
   ```

   Or with Node.js:

   ```bash theme={null}
   node -e "console.log(require('bcryptjs').hashSync(process.argv[1], 10))" 'NewTempPassword123!'
   ```

3. Patch the `user` JSON in the Secret with the new hash and force a password change on next login:

   ```bash theme={null}
   SECRET=falkordb-user-admin-example-com
   NS=falkordb-system
   HASH='$2y$10$...'

   kubectl -n "$NS" get secret "$SECRET" -o jsonpath='{.data.user}' | base64 -d \
     | jq --arg hash "$HASH" '.password = $hash | .mustChangePassword = true | .updatedAt = (now | todate)' \
     | base64 \
     | xargs -I{} kubectl -n "$NS" patch secret "$SECRET" -p '{"data":{"user":"{}"}}'
   ```

4. Log in with the new password. You are prompted to change it immediately (`mustChangePassword` is set).

If local logins are disabled (`DISABLE_LOCAL_AUTH=true` on the admin server), re-enable local auth temporarily via `adminServer.env` before resetting, then disable it again afterwards.

## Resetting other users' passwords

If an admin **can** log in, reset other users' passwords through the product instead of touching Secrets:

* **Admin UI**: open **Users**, select the user, select **Reset Password**, and share the temporary password through a secure channel. Requires `users:update` permission.

* **CLI**:

  ```bash theme={null}
  falkordb-admin users reset-password user@example.com
  ```

* **API**:

  ```bash theme={null}
  curl -f -X POST "http://localhost:3000/api/users/user%40example.com/reset-password" \
  	-H 'Content-Type: application/json' \
  	-b cookies.txt \
  	-d '{}'
  ```

In all cases the server generates a random temporary password, sets `mustChangePassword: true`, and returns it in the response:

```json theme={null}
{
  "message": "Password reset successfully",
  "tempPassword": "<generated>"
}
```

## Notes

* Resets performed through the API are recorded in the audit log as `user.password_change`. Direct Secret edits are not audited, so record them in your change management process.
* Bootstrap values reference: `adminServer.bootstrap.adminUser.*` in [Helm values](/enterprise/reference/helm-values).