n8n forgot password: how to get back in (owner, member and 2FA)

Getting locked out of a self-hosted n8n instance is common, because the “Forgot my password” link only works when n8n can send email, and most self-hosted installs never set that up. We locked ourselves out of n8n 2.43.5 in every way covered below on 12 November 2026 and tested each way back in, including what the reset command keeps and what it deletes. Every message and result here is from those tests.

Which fix do you need?

Your situation	Fix
You are a member and forgot your password	Fix 1: owner copies a reset link
You are the owner, and n8n can send email	Fix 2: Forgot my password
You are the owner, and you see “Please contact your admin”	Fix 3: reset user management
You lost your two-factor (2FA) device	Fix 4: recovery code or disable 2FA
Sign-in says “Too many requests, please try again later.”	Wait one minute

Fix 1: a member forgot their password

The owner can create a reset link for any other user, and this works without email. Sign in as the owner, open Settings > Users, click the three dots at the end of the user’s row and choose Copy Password Reset Link. Send that link to the user, who opens it and sets a new password.

In our test, the link worked once and then stopped working, and it was valid for 20 minutes, so send it right away. The owner’s own row has no such menu, which is why the owner needs Fix 2 or Fix 3.

Fix 2: the owner forgot the password and email is set up

Click Forgot my password on the sign-in page, enter your email, and open the link in the “n8n password reset” email. As with Fix 1, the link expires after 20 minutes.

If you click Forgot my password and see this instead, n8n has no email settings, and the page cannot send anything:

Please contact your admin. n8n isn't set up to send email right now.

You have two options. Add email settings now, which takes a restart and then lets you use Forgot my password, or skip to Fix 3. To add email, put your mail provider’s SMTP details in n8n’s environment and restart n8n:

- N8N_EMAIL_MODE=smtp
- N8N_SMTP_HOST=smtp.yourprovider.com
- N8N_SMTP_PORT=465
- N8N_SMTP_SSL=true
- N8N_SMTP_USER=you@yourdomain.com
- N8N_SMTP_PASS=your-smtp-password
- N8N_SMTP_SENDER=n8n <you@yourdomain.com>
- N8N_EDITOR_BASE_URL=https://n8n.yourdomain.com/

Do not skip the last line. Without it, the reset email in our test linked to http://localhost:5700/change-password?..., which only works on the server itself. With N8N_EDITOR_BASE_URL set, the link used the public address. Setting only N8N_HOST and N8N_PROTOCOL was not enough: the link then included n8n’s internal port (https://n8n.yourdomain.com:5700/...), which fails behind a reverse proxy. If you already set N8N_WEBHOOK_URL to your public address, the link used that too.

Fix 3: the owner forgot the password and email is not set up

n8n has a command that puts user management back to its first-run state, so you can create the owner account again. Before you run it, know exactly what it does. This is what we found after running it on an instance with an owner, a member, three workflows and two credentials:

After n8n user-management:reset	Result in our test
Owner account	Email, name and password cleared. You set them again on the setup screen
Member accounts	Deleted. They have to be invited again
Workflows	Kept, including members’ workflows, which moved to the owner
Credentials	Kept and still decrypted correctly, including members’ credentials
Active workflows	Kept running. A schedule that ran every minute did not miss a run
Signed-in sessions	Ended immediately

So if your instance has members, try Fix 2 first by adding email. If you are the only user, the reset is quick and safe.

Step 1: back up your workflows and credentials

The reset kept everything in our test, but take a backup anyway. With Docker:

docker exec -u node -it n8n n8n export:workflow --all --output=/home/node/.n8n/backup-workflows.json
docker exec -u node -it n8n n8n export:credentials --all --output=/home/node/.n8n/backup-credentials.json

Replace n8n after -it with your container’s name if it is different (docker ps shows it). Both files are saved inside n8n’s data volume. The credentials file stays encrypted with your encryption key, so keep that key too (see our encryption key guide).

Step 2: run the reset

With Docker:

docker exec -u node -it n8n n8n user-management:reset

With Docker Compose, run it from the folder with your docker-compose.yml, using the service name:

docker compose exec -u node n8n n8n user-management:reset

If you installed n8n with npm, run n8n user-management:reset as the same user and with the same environment variables that n8n runs with, so it uses the same database.

You should see:

Successfully reset the database to default user state.

Step 3: create the owner account again

Open n8n in your browser. In our test, the running instance showed the owner setup screen straight away, with no restart. If you still see the sign-in page, restart n8n. Enter your email, name and a new password, and you are back in with your workflows and credentials. If you had members, invite them again from Settings > Users. Their old workflows and credentials are now in your personal space, and you can share them back.

Fix 4: you lost your two-factor device

When 2FA is on, n8n asks for a “Two-factor code” after your password. Below the box, click Enter a recovery code and type one of the recovery codes n8n showed when you turned 2FA on. In our test, n8n created 10 codes, and each one worked once. Using a code twice gave:

Invalid mfa token or recovery code

Once you are in, go to Settings > Personal and set up 2FA again on your new device.

If you have no recovery codes either, turn off 2FA for your account from the server, using the email you sign in with:

docker exec -u node -it n8n n8n mfa:disable --email=you@yourdomain.com

The expected output is Successfully disabled MFA for user with email: you@yourdomain.com. If you get the email wrong, it says User with email: ... does not exist and changes nothing. After that, you sign in with the password alone. Nothing else changes. We tested it on the owner account, and n8n’s documentation describes it for any user.

“Too many requests, please try again later.”

After five sign-in attempts within one minute for the same email address, n8n blocks further attempts and returns this message, even when the next password is correct. The response tells the browser to retry after 60 seconds. In our test, the right password worked again after one minute, and a different email address was not affected. So stop, wait a full minute, then try once. Rapid retries keep the block going.

Prevent the next lockout

• Store the owner password in a password manager, and save the 2FA recovery codes when you turn 2FA on.
• Set up email with N8N_EDITOR_BASE_URL, so Forgot my password works.
• If several people use the instance, give a second person admin rights where your plan allows it. On the free plan, the owner is the only admin.
• Keep backups of your workflows and of the encryption key. Our security checklist covers both.

If you are locked out and would rather not run commands on a live server, we can do it for you as part of our n8n workflow fix service.

Try n8n Cloud free

Frequently asked questions

Does n8n user-management:reset delete my workflows?

No. In our test, all workflows and credentials stayed, and active workflows kept running. It deletes all user accounts except the owner, and clears the owner’s login details.

Can I reset the n8n password without email?

Yes. A member can get a reset link from the owner (Settings > Users > Copy Password Reset Link). The owner can run n8n user-management:reset and set up the account again.

Why does the n8n reset email link to localhost?

n8n builds the link from its own address. Set N8N_EDITOR_BASE_URL to your public URL, such as https://n8n.yourdomain.com/, and restart n8n.

How long is an n8n password reset link valid?

20 minutes in our test, and it works only once. If it has expired, request a new one.

I use n8n Cloud. Does this apply?

No. On n8n Cloud, use Forgot my password on the sign-in page, or contact n8n support. The server commands here are for self-hosted n8n.

How we tested: on 12 November 2026 we ran n8n 2.43.5 with SQLite and set up an owner, a member, three workflows (one active on a one-minute schedule) and two credentials. We tested the reset link from Settings > Users, Forgot my password with and without email settings (using a local test mail server), user-management:reset (twice), 2FA with recovery codes, mfa:disable and the sign-in rate limit. We ran the commands directly with the n8n CLI. With Docker, the same commands run inside the container through docker exec, as shown in n8n’s documentation.

Sources: n8n: use the command line, n8n user management and 2FA environment variables, n8n user management.