How to Force Joomla Users to Reset Their Passwords

Joomla can require an existing user to choose a new password the next time that account signs in. This is useful when you have assigned a temporary password, responded to a credential concern, or want a specific account to stop using its current password.

Before You Begin

Sign in to Joomla Administrator with an account that is allowed to manage users. For an individual account, the safest approach is to edit that user rather than changing authentication or registration settings for the whole site.

Require a Password Reset for a User

Open Users → Manage in Joomla Administrator.
Select the user's name to open the user edit screen.
If you are assigning an interim password, enter it in the password fields. Do not reuse a password from another account.
Set Require Password Reset to Yes.
Select Save & Close.

At the user's next successful login, Joomla requires the account to replace the interim/current password before normal navigation continues.

Give the User a Safe Way to Sign In

If you set an interim password, deliver it through an appropriate secure channel and tell the user to change it immediately. If the user can use Joomla's normal forgotten-password workflow instead, that avoids an administrator choosing and transmitting a temporary password.

Verify the Reset Requirement

Reopen the user record and confirm the reset requirement was saved. When practical, have the user sign in and verify that Joomla presents the password-change flow. Do not test by asking the user to disclose the new password.

If the User Is Not Prompted

Confirm you edited the correct account and saved the change. Also check whether the site's login is handled by core Joomla authentication or by a third-party identity provider, SSO service, membership extension, or other authentication system. External authentication systems can own password policy and reset behavior instead of Joomla.

Need More Help with Joomla?

Still having trouble? Open a support ticket with QuantaCade Support and we'll be happy to help where we can.

Support priority is given to QuantaCade products, services, and customers. However, we're also happy to assist fellow Joomla users with general Joomla questions and troubleshooting when possible.

QuantaCade is an independent Joomla extension developer and is not official Joomla support. Some issues involving third-party extensions, hosting environments, server configurations, or other systems outside our development control may be beyond what we're able to resolve.

Open a Support Ticket

Joomla can require an existing user to choose a new password after the next successful sign-in. This is useful after issuing a temporary password, responding to a credential concern, or enforcing a reset for a specific account without changing the site-wide authentication policy.

Confirm the account and authentication method

Before changing the user, confirm that Joomla itself manages the account password. Sites using SSO, LDAP, an external identity provider, or a membership/authentication extension may require password changes in that external system instead. Also verify that you are editing the intended user account and that its email address and group memberships are correct.

Require the user to reset the password

Sign in to Joomla Administrator with an account permitted to manage users.
Go to Users → Manage.
Open the user who must change the password.
Set Require Password Reset to Yes.
If you must assign a temporary password, enter it in the password fields and communicate it through an appropriate secure channel.
Select Save & Close.

At the next successful Joomla login, the account should be directed through the password-change requirement before normal use continues.

Prefer self-service recovery when appropriate

If the user still controls the account email address, Joomla's normal forgotten-password workflow can be preferable to an administrator choosing and transmitting a temporary password. Confirm that Joomla mail delivery works and that password-reset messages reach the user. Do not weaken password policy or authentication settings simply to make one account easier to recover.

Verify the forced reset

Reopen the user record and confirm the reset requirement was saved.
Use a clean browser session for testing.
Sign in as the affected user with the current or temporary password.
Confirm Joomla requires a new password before normal navigation continues.
Complete the change and verify the new password works on a fresh login.

If the user is not prompted, confirm the login is actually being handled by Joomla core authentication and not by an external identity system.

Use forced resets carefully during a security response

A forced password change is only one part of responding to suspected credential compromise. Review privileged accounts, user-group assignments, multi-factor authentication, authentication plugins, active integrations, and relevant logs as appropriate. If several users may be affected, plan the communication and support path before forcing widespread resets so legitimate users are not unnecessarily locked out.

Troubleshoot common reset problems

If the user cannot complete the reset, check whether the account is blocked, whether the login route is available to that user's access level, and whether an extension or template override changes the login workflow. For externally managed accounts, use the identity provider's password-reset process. Avoid direct database password manipulation when normal Joomla recovery and Administrator controls are available.

Need More Help with Joomla?

Still having trouble? Open a support ticket with QuantaCade Support and we'll be happy to help where we can.

Support priority is given to QuantaCade products, services, and customers. However, we're also happy to assist fellow Joomla users with general Joomla questions and troubleshooting when possible.

Open a Support Ticket