For various reasons, I need to create a Joomla user from outside Joomla. Following advice, I'm using passwordhash.php for the hashing so I use something like

$t_hasher = new PasswordHash(10, TRUE);
$jpassword = $t_hasher->HashPassword($rsnew["password"]); 

Then directly add a record containing name, email, username and this hashed password into the Joomla ..._users table. (I also add the relevant record into the ..._user_usergroup_map table)

The record looks fine in the database but I can't login - "Username and password do not match or you do not have an account yet."

However, I can authenticate successfully from an external program against the Joomla ..._users table using something like...

$mysql = "SELECT password FROM jos_users WHERE username = '".$usr."'";
   $t_hasher = new PasswordHash(10, TRUE);
   if ($t_hasher->CheckPassword($pwd, $mydb->get_var($mysql))) {
      return TRUE;

Obviously the stored password hash is correct in some way otherwise I wouldn't be able to authenticate it from outside but why won't Joomla accept it?

(If I go into Joomla admin and change the password, then I can correctly authenticate from both inside and outside Joomla.)

Any ideas Thanks

1 Answer 1


You should use the internal Joomla functions to create and handle user accounts.

See the answer here: https://stackoverflow.com/questions/1904809/how-can-i-create-a-new-joomla-user-account-from-within-a-script

Implementing Joomla framework and adding new user (#4-#8): https://diadem.in/blog/two-ways-to-add-joomla-users-using-your-custom-code/

I do something like this in my components to generate the password hash:

$salt = JUserHelper::genRandomPassword(32);
$crypt = JUserHelper::getCryptedPassword('your_password', $salt);
$password_hash = $crypt.':'.$salt;

Script for creating user (tested J3.7.x):

define( '_JEXEC', 1 );
define('JPATH_BASE', dirname(__FILE__) );//this is when we are in the root

require_once ( JPATH_BASE .DS.'includes'.DS.'defines.php' );
require_once ( JPATH_BASE .DS.'includes'.DS.'framework.php' );

$app = JFactory::getApplication('site');

$params = array(
    'email'=>'[email protected]',


$udata = array(
    'groups'=>array(2), // set the usergroup(s) here (id)


$user = new JUser;

    echo '<pre>';
    echo 'Bind user data: ';

    echo 'Save user data: ';

    echo 'Testing login: ';
    var_dump( $app->login( array('username'=>$params['username'],'password'=>$params['password']) ) );

} catch (Exception $ex) {

    echo 'Exception: ',  $e->getMessage(), '\n';


As you can see, there is no need to hash the password beforehand.

  • Yes but the application where I want to create the password is entirely independent of Joomla - it's not a component. How do you use any Joomla internal functions if you are writing something outside it??
    – SteveG
    Commented Jul 29, 2017 at 12:31
  • Import the Joomla framework like in the second link provided above. Commented Jul 29, 2017 at 12:36
  • Hmmm. That link seems to bear little relevance to current Joomla versions. I'll see if I can extrapolate across to the current version but there doesn't seem to be much commonality.
    – SteveG
    Commented Jul 30, 2017 at 19:55
  • Updated my answer with a tested script. Commented Jul 31, 2017 at 9:44
  • 1
    Thanks - VERY helpful. That got me pointed in the right direction. Your script works fine stand-alone and I now just need to sort out some problems when it is incorporated in PHPMaker. Obviously it and Joomla are having a session disagreement and giving me " ini_set(): A session is active." errors but that's a separate problem!
    – SteveG
    Commented Jul 31, 2017 at 18:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.