Reset the admin password

If you lose the Brivacia admin password, you can reset it with a temporary PHP file.

Brivacia stores the admin username and password hash in:

data/settings.json

The reset file must be deleted immediately after use.

1. Choose your new password

In the PHP file below, replace this value:

$newPassword = 'CHANGE_THIS_PASSWORD';

with the new password you want to use.

For example:

$newPassword = 'my-new-secure-passwOrd!';

2. Create the temporary file

Create this file at the root of your Brivacia installation:

reset-admin-password.php

Paste this code inside, then edit $newPassword before opening it in your browser:

<?php
declare(strict_types=1);

/*
 * Temporary Brivacia admin password reset.
 *
 * 1. Edit $newPassword below.
 * 2. Upload this file at the root of Brivacia.
 * 3. Open it once in your browser.
 * 4. Delete this file immediately.
 */

$newPassword = 'CHANGE_THIS_PASSWORD';

header('Content-Type: text/plain; charset=utf-8');

if ($newPassword === '' || $newPassword === 'CHANGE_THIS_PASSWORD') {
    http_response_code(400);
    echo "Edit this file and set a real password first.\n";
    exit;
}

$settingsFile = __DIR__ . '/data/settings.json';

if (!is_file($settingsFile)) {
    http_response_code(500);
    echo "settings.json not found.\n";
    exit;
}

$settings = json_decode((string)file_get_contents($settingsFile), true);

if (!is_array($settings)) {
    http_response_code(500);
    echo "settings.json is not valid JSON.\n";
    exit;
}

if (
    !isset($settings['admin']) ||
    !is_array($settings['admin']) ||
    trim((string)($settings['admin']['username'] ?? '')) === ''
) {
    http_response_code(500);
    echo "Admin username not found in settings.json.\n";
    exit;
}

$settings['admin']['password_hash'] = password_hash($newPassword, PASSWORD_DEFAULT);

$tmp = $settingsFile . '.tmp';

$ok = file_put_contents(
    $tmp,
    json_encode(
        $settings,
        JSON_PRETTY_PRINT | JSON_UNESCAPED_SLASHES | JSON_UNESCAPED_UNICODE
    ),
    LOCK_EX
);

if ($ok === false) {
    http_response_code(500);
    echo "Unable to write temporary settings file.\n";
    exit;
}

if (!rename($tmp, $settingsFile)) {
    @unlink($tmp);
    http_response_code(500);
    echo "Unable to replace settings.json.\n";
    exit;
}

echo "Admin password reset done.\n";
echo "Username kept: " . $settings['admin']['username'] . "\n";
echo "Delete this file now.\n";

3. Run the file

Open it once in your browser:

https://your-brivacia-domain.example/reset-admin-password.php

If everything is OK, it will show:

Admin password reset done.
Delete this file now.

4. Delete the file

Delete this file immediately:

reset-admin-password.php

Never keep it on the server.

After the password reset, log in again with the same username and the new password.

Existing admin cookies become invalid because the password hash is part of Brivacia’s signed cookie secret.

Do you find this project useful? You can support its development using the buttons in the page footer.