iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
The supported way to reset a Django admin password on a VPS is to run python manage.py changepassword <username> from the deployed project directory, using the same virtual environment, settings, and database as the live site. Django asks for the replacement password twice and saves it only when both entries match.
If you do not know the username or use a custom user model, open the Django shell and call set_password() on the intended account. If the account no longer exists, create a new privileged account with createsuperuser. The commands below show how to select the live deployment safely and diagnose a login that still fails.
Free tools Windows power users keep installed
One-click scans. No signup required.
Choose the right recovery method
Your choice depends on what you know about the deployed application and its users.
| Situation | Use | Why |
|---|---|---|
| You know the existing username | changepassword |
Shortest supported, interactive reset. |
| The project logs in with email, or the username is uncertain | Django shell with get_user_model() |
Lets you query the configured user model using a project-specific field. |
| The original admin account is gone | createsuperuser |
Creates a new account with all permissions. |
| User data is not in the default database | Add --database <alias> |
Targets the configured database alias that contains the live users. |
Do not run any command until you have identified the project directory, Python environment, settings selection, and database used by the running site. A successful command against a development SQLite file is still a failed production recovery.
Before changing anything: identify the live Django installation
Connect over SSH
Connect to the VPS with an account permitted to read and execute the deployed application. The exact SSH command, host name, port, and account are deployment-specific. Use the same operating-system account normally used for application maintenance, rather than copying credentials into a command line or script.
Find the deployed manage.py
Change to the directory that contains the manage.py used by the live service. Common layouts place it in a release directory, an application directory, or a subdirectory beneath a deployment root, but there is no universal VPS path. Check the process manager or deployment configuration if several copies exist.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Once there, verify the file before proceeding:
pwd
ls -l manage.pyIf ls reports that the file is missing, stop and locate the correct release. Running a command from a neighboring project can load a different settings module or database.
Use the same Python environment as the site
Activate the project virtual environment, if the deployment uses one:
source /path/to/venv/bin/activateReplace the example path with the environment configured for the live service. Alternatively, invoke that environment’s interpreter directly:
/path/to/venv/bin/python manage.py --versionChecking the version confirms that Python can load Django from the selected environment. If the project relies on environment variables, load them exactly as the deployment does. Settings modules, database URLs, secret keys, and other configuration values may be supplied by the shell, a service definition, or a deployment wrapper.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsConfirm which settings and database are loaded
Django commands use the settings selected by the current environment. A different DJANGO_SETTINGS_MODULE, missing production variables, or a shell that does not load the service environment can point the command at development data. Before changing a password, compare the shell environment with the application service configuration and identify the database alias containing the live user records.
If the project defines more than one database, note the alias explicitly. Django uses the default alias when no database option is supplied.
Reset a known username with changepassword
Run the supported command
- SSH to the VPS.
- Change to the directory containing the live
manage.py. - Activate the live virtual environment, or use its Python interpreter directly.
- Run the command with the existing account name:
python manage.py changepassword <username>For example, if the account is named siteadmin:
python manage.py changepassword siteadminDjango prompts for a new password twice. Enter the replacement value at both prompts. The password is changed only when the two entries agree. Terminal input is normally hidden, so nothing appearing while you type is expected.
Select a non-default database
If the live users are stored under another configured alias, specify it:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
python manage.py changepassword <username> --database <alias>For example:
python manage.py changepassword siteadmin --database primaryThe alias must be defined in the project’s DATABASES setting. It is not the database server name, schema name, or operating-system service name unless the project happens to use the same text for all of them.
What success and failure look like
A successful run returns to the shell after accepting the two matching entries. If Django reports that the user cannot be found, first verify spelling, case, the custom login field, settings, and database alias. If it cannot import settings or an installed app, the command is running outside the application’s required environment or with incomplete configuration.
Do not repeatedly guess passwords at the prompt. Stop and verify the target account and database so that you do not lock yourself into an uncertain recovery path or alter an unintended record.
Reset through the Django shell when lookup is more complex
The shell is useful when the project authenticates by email, has a custom user model, or requires a scripted lookup. It also lets you inspect whether a matching account exists before changing it.
Recommended Free Tools
Open the shell in the live environment
python manage.py shellUse the same directory, interpreter, settings, and optional --database context that you verified for the command-line reset. If the project has multiple databases, ensure the ORM query reaches the live user store according to its routers and configuration.
Load the configured user model
Do not import a hard-coded user class unless the project explicitly uses it. Load the model selected by AUTH_USER_MODEL:
from django.contrib.auth import get_user_model
User = get_user_model()Query a field that uniquely identifies the intended account. Email is only an example; some projects use a username, employee identifier, UUID, or another required field:
user = User.objects.get(email="admin@example.com")If the lookup can match more than one row, do not continue. Refine it until exactly one account is selected. A broad filter followed by an arbitrary first result can change the wrong administrator.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Set and save the password correctly
user.set_password("use-a-new-unique-password")
user.save(update_fields=["password"])set_password() runs Django’s password-hashing logic and stores an encoded hash. Never assign a clear-text value directly to user.password; doing so writes a value that authentication will not interpret as a valid Django password hash.
Do not paste a real production password into shell history, a ticket, a deployment script, or source control. For an interactive recovery, type it privately. If a scripted change is unavoidable, use the team’s approved secret-handling process and remove temporary material afterward.
Inspect account state before leaving the shell
After selecting the user, inspect the fields relevant to admin access:
user.is_active
user.is_staff
getattr(user, "is_superuser", None)Values and required fields vary with custom user models, but an inactive account normally cannot authenticate, and the built-in admin generally requires staff status. A superuser has all permissions, while a staff user may have only the permissions explicitly granted by the project. Do not change authorization flags merely to hide a password problem; confirm the project’s intended access policy first.
Create a replacement administrator when the account is missing
If the original account does not exist, use the documented interactive command:
python manage.py createsuperuserDjango prompts for the identity fields required by the configured user model and for a password. The resulting account has all permissions. Custom user models may require fields beyond a normal username and email, and some projects use email as the login identifier, so answer the prompts according to that project’s model.
Run this against the live database and settings. Creating a superuser in a local SQLite file does not create an account on the public site. After creation, record which account was added through the normal administrative change-control process and remove any temporary account that is no longer justified.
Why the new password can still fail at /admin/
The command changed a different database
This is the most common VPS-specific cause. The shell may have loaded a development settings module, a different release, a different .env file, or the default alias while the application reads another alias. Compare the command’s environment with the running service and repeat the operation only after confirming the live connection.
The account is inactive or not permitted into the admin
Password validity does not grant admin access by itself. Check the account’s active state and the staff requirement enforced by the project. A custom authentication backend may impose additional rules, such as organization membership, two-factor enrollment, email verification, or an external identity provider.
The project uses a custom user model or email login
An email address may be the login identifier even when the database field is not named username. Use get_user_model() and query the configured unique field. Do not create a second account simply because a username lookup failed; first establish how the application identifies users.
The admin URL is not the path you tried
Django’s admin is often mounted at a custom URL rather than /admin/. Check the project’s URL configuration and deployment documentation. A 404 or redirect can indicate an incorrect path, while an authentication error at the correct path points to a different class of problem.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchThe browser is using stale sessions or cookies
Test in a private browser window or clear cookies for the site after confirming the server-side change. If another user’s password was changed, existing sessions may be invalidated according to Django’s password/session behavior and the project’s authentication setup. A deployment may also have custom session storage or authentication middleware that changes the user experience.
The application process needs its normal reload
A password row is read from the database, so there is no universal Django restart command for this operation. Nevertheless, a project may require its standard process-manager or application-worker reload after configuration changes, especially if the command and web service were not using the same environment. Follow the deployment’s documented reload procedure; do not invent a service name or restart command.
Understanding the command context and database choice
manage.py is only a launcher; it does not inherently know which copy of the project serves public traffic. The settings module selected in the current shell determines installed applications, authentication configuration, database connections, and the configured user model. That is why running the same command from two release directories can produce different results without any syntax error.
When a deployment has blue-green releases, symlinked directories, or separate worker and web environments, identify the release currently serving requests before changing data. Compare the environment variables and database configuration used by the process manager with those present in the SSH session. If the service uses a wrapper script to load secrets or settings, invoke the management command through the same wrapper or reproduce its environment according to local procedures.
The --database value is a Django connection alias. It must match an entry configured in DATABASES; it is not automatically inferred from a provider name or a host address. If no option is supplied, Django selects default. Selecting an alias that exists but does not contain the live user rows can still produce a plausible-looking successful reset, so verify the data source rather than relying only on command output.
A practical troubleshooting decision path
- The command cannot start: check the working directory, interpreter, installed Django package, settings module, and required environment variables.
- The username is not found: confirm the spelling and login field, then use
get_user_model()in the live shell to identify the configured model and account. - The command completes but the site rejects the password: confirm the database alias and settings match the web process, then inspect
is_activeandis_staff. - The login page is missing or redirects unexpectedly: verify the project’s admin URL and any reverse-proxy routing before changing the password again.
- The password works in one browser but not another: test a private window and clear site cookies, then check the project’s session and authentication middleware.
This order prevents destructive repetition. Each symptom narrows the likely layer—shell environment, account lookup, authorization, routing, or browser state—so you can correct the relevant setting instead of creating extra accounts or overwriting the wrong record.
Password policy, hashing, and validation details
Django’s password field contains an encoded hash that includes the information needed for authentication; it is not a clear-text secret. The hashing format and algorithm are handled by Django’s password API. Calling set_password() is therefore required even when a password is being changed from a trusted SSH session.
Password validators configured through AUTH_PASSWORD_VALIDATORS are used by the interactive changepassword and createsuperuser commands by default. A direct model save does not automatically invoke those validators. If your team uses the shell fallback, apply the project’s approved password policy through its normal validation process rather than assuming that every model save enforces it.
Use a long, unique replacement password and keep it out of command-line arguments, shell history, logs, tickets, and source control. Hidden terminal input protects display, not every form of recording. Follow the VPS team’s procedure for removing temporary files or history entries, and rotate any credential that was exposed during the recovery.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.When each method is the safer choice
Use changepassword when you have a verified username and want Django’s normal interactive validation. Use the shell when the project uses email or another identifier, when you must inspect account state, or when the configured user model is not the standard one. Use createsuperuser only after confirming that no suitable administrator exists; otherwise a second full-privilege account can complicate auditing and incident response.
For a multi-database deployment, make the alias an explicit part of the recovery record. Note the release directory, interpreter, settings selection, account identifier, and database alias used. This documentation makes it possible to explain exactly which record changed without recording the password itself.
A safe recovery checklist
- Use an SSH account authorized to maintain the deployed application.
- Confirm the directory contains the live
manage.py. - Use the same virtual environment and Python interpreter as the web service.
- Load the production settings and required environment variables.
- Identify the database alias that contains live users; remember that the default is
default. - Prefer
changepasswordwhen the username is known. - Use
get_user_model()andset_password()for custom lookups. - Never write a raw password directly to the password field.
- Verify the account’s active and staff status when admin access requires them.
- Test the correct admin URL in a private browser session.
- Remove temporary credentials and handle shell history according to the VPS team’s security procedures.
Practical command sequences
Known username, virtual environment activation
cd /path/to/live/project
source /path/to/venv/bin/activate
python manage.py changepassword siteadminKnown username, direct interpreter and database alias
cd /path/to/live/project
/path/to/venv/bin/python manage.py changepassword siteadmin --database primaryCustom lookup by email
cd /path/to/live/project
source /path/to/venv/bin/activate
python manage.py shellfrom django.contrib.auth import get_user_model
User = get_user_model()
user = User.objects.get(email="admin@example.com")
user.set_password("use-a-new-unique-password")
user.save(update_fields=["password"])No existing administrator
cd /path/to/live/project
source /path/to/venv/bin/activate
python manage.py createsuperuserEvery path, account name, email address, database alias, and password in these examples is illustrative. Replace them only after checking the actual deployment.
What to do after successful login
Sign in through the verified admin URL and confirm that the intended account can perform only the administrative actions it is supposed to perform. Check that no accidental second account was created, document the recovery according to your change-control policy, and rotate any temporary access material exposed during the incident. Keep the replacement password unique and long, and do not reuse it for SSH, database, email, or other services.
Frequently Asked Questions
What is the exact Django command to reset a known admin password?
From the live project directory and environment, run python manage.py changepassword <username>. Enter the new password twice. If the users are in another configured connection, add --database <alias>.
Can I reset the password if the site logs in with an email address?
Yes. Open python manage.py shell, load get_user_model(), query the unique email field, call user.set_password(), and save the password field. Do not assign clear text directly to user.password.
Why does changepassword say the user does not exist?
Check that you are using the live release, settings, virtual environment, and database alias. The project may also use a custom user model or email as its login identifier, so inspect the configured model in the Django shell before creating another account.
Do I need to restart Gunicorn, uWSGI, or another VPS service?
There is no universal Django restart command for a password-row change. Follow the deployment’s normal process-manager procedure only if that project requires a reload, and first verify that the command and web process use the same environment and database.
What account flags are needed for Django admin access?
An active account is normally required, and the built-in admin generally requires staff status. A superuser has all permissions. Custom authentication backends can add requirements such as organization membership, two-factor enrollment, or email verification.
What if the original administrator was deleted?
Run python manage.py createsuperuser against the live settings and database. Complete the identity fields required by the custom user model, record the new privileged account, and remove it later if it was only temporary.
Are passwords stored in plain text after this reset?
No. Django stores an encoded password hash. The supported changepassword command and set_password() API apply the hashing logic; writing a raw value directly to the password field will not produce a valid Django password.
Recommended Free Tools
The Bottom Line
Reset the account from the live manage.py using the matching environment and database: prefer changepassword for a known username, use get_user_model() with set_password() for custom lookups, and use createsuperuser only when no suitable account remains. If login still fails, verify the database, account flags, custom authentication rules, admin URL, and browser session before repeating the change.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
