In what format does Joomla! stores the password

Question

I am looking at the Joomla! .htaccess file. In which encoding does Joomla! stores the password. Can it be decoded as well?

Answer 1

.htaccess file has nothing to do with Joomla! passwords.

Joomla < 3.2

Passwords are MD5 hashed and salted. Salt is 32 characters long random string. They are stored in database like {hash}:{salt}.

Joomla >= 3.2

Like @Lodder said, starting from 3.2, passwords are hashed using Bcrypt.

These passwords can't be decrypted.

If you want to recover your lost admin password, follow Joomla! docs about How do you recover or reset your admin password?.

Answer 2

You've specifically tagged your question with Joomla 3.x, so assuming you're using Joomla 3.2 or later, passwords are hashed using the Bcrypt which is considered one the best method available today.

MD5 hash and salt were used in older versions of Joomla

The passwords are stored in the #__users table and no, they can not be decoded, but can be reset.