I am looking at the Joomla! .htaccess file. In which encoding does Joomla! stores the password. Can it be decoded as well?


2 Answers 2


.htaccess file has nothing to do with Joomla! passwords.

Joomla < 3.2

Passwords are MD5 hashed and salted. Salt is 32 characters long random string. They are stored in database like {hash}:{salt}.

Joomla >= 3.2

Like @Lodder said, starting from 3.2, passwords are hashed using Bcrypt.

These passwords can't be decrypted.

If you want to recover your lost admin password, follow Joomla! docs about How do you recover or reset your admin password?.


You've specifically tagged your question with Joomla 3.x, so assuming you're using Joomla 3.2 or later, passwords are hashed using the Bcrypt which is considered one the best method available today.

MD5 hash and salt were used in older versions of Joomla

The passwords are stored in the #__users table and no, they can not be decoded, but can be reset.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.