I want to post an update to this question for EE 5 because the current answer is pretty outdated.
In order to set a member's password in the DB, you'll need to know what the hash algorithm is. From
/system/ee/legacy/libraries/Auth.php we can see the possible options that EE might use:
private $hash_algos = array(
128 => 'sha512',
64 => 'sha256',
40 => 'sha1',
32 => 'md5'
When updating a password, the system will use the first available hash algorithm (in order of most to least secure) to encrypt the password in the database. This array has keys defining the length of the salt value, and values are the name of a valid algorithm to be used by PHP's hash().
Aside: if you need to reset a user's
salt too, it needs to be a string of length matching the above
key. Example: if the hash algorithm being used is
salt needs to be
64 characters long (as seen in the key/value above),
md5 would require a
32 character string, etc.
The Auth library uses the following logic to generate the salt:
for ($i = 0; $i < $h_byte_size; $i++)
$salt .= chr(mt_rand(33, 126));
which equates to a string of length
key with random ASCII characters between
! (33) and
The following is returned from
'salt' => $salt,
'password' => hash($this->hash_algos[$h_byte_size], $salt.$password)
which gets called from
update_password() and the values are written directly to the database.
In summary, if you need to manually reset a member's password (ex:
test) directly in the database, you can run the following MySQL query:
SET password = SHA2(CONCAT(salt, 'test'), 512)
WHERE member_id = 1234;
which is the MySQL equivalent to what
This query uses the existing salt, and you may need to replace
512 to match the algorithm used on the server (from https://stackoverflow.com/questions/12612279/hashing-an-entire-column-using-sha512).