# Resetting User Passwords in KeycloakNew Page

Password resets are a critical part of account lifecycle management. Keycloak provides multiple secure methods for resetting a user’s password manually through the Admin Console, programmatically via REST API, or via user self-service workflows using email links. This guide walks through all these approaches, including configuration steps, best practices, and common issues.

## **Resetting Password via Admin Console**

This is the most direct method for administrators to reset passwords.

#### **Access the Admin Console**

Log in to:

```
http://<your-keycloak-domain>/admin/
```

Select the desired realm.

#### **Reset a User’s Password**

1. <span class="s1">Go to </span>**Users &gt; \[username\] &gt; Credentials**
2. <span class="s1">Under </span>**Set Password**<span class="s1">:</span>
    
    
    - Enter a new password
    - Confirm it
    - <span class="s1">Toggle </span>**Temporary**<span class="s1">:</span>
        
        
        - <span class="s1">**ON**</span> = user will be forced to change it on next login
        - <span class="s1">**OFF**</span> = permanent change
3. <span class="s1">Click </span>**Set Password**

The new password takes effect immediately.

[![image.png](https://docs.elest.io/uploads/images/gallery/2025-06/scaled-1680-/BPHimage.png)](https://docs.elest.io/uploads/images/gallery/2025-06/BPHimage.png)

## **Resetting Password via REST API**

#### **Get Admin Access Token**

```bash
curl -X POST "https://<keycloak-domain>/realms/master/protocol/openid-connect/token" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "username=admin" \
  -d "password=admin-password" \
  -d "grant_type=password" \
  -d "client_id=admin-cli"
```

#### **Set New Password for a User**

```bash
curl -X PUT "https://<keycloak-domain>/admin/realms/<realm>/users/<user-id>/reset-password" \
  -H "Authorization: Bearer <access_token>" \
  -H "Content-Type: application/json" \
  -d '{
    "type": "password",
    "value": "SecurePassword123!",
    "temporary": false
  }'
```

<span class="s1">To get </span>&lt;user-id&gt;<span class="s1">:</span>

```bash
curl -H "Authorization: Bearer <access_token>" \
  https://<keycloak-domain>/admin/realms/<realm>/users?username=<username>
```

## **Resetting Password via Docker CLI** 

#### **Inside the Container**

```
docker exec -it keycloak bash
```

#### **Reset User Password**

```bash
/opt/keycloak/bin/kcadm.sh config credentials \
  --server http://localhost:8080 \
  --realm master --user admin --password admin

/opt/keycloak/bin/kcadm.sh set-password -r <realm> \
  --username <username> --new-password "SecurePassword123!" --temporary=false
```

## **Resetting Password via Email (Self-Service)**

#### **Configure SMTP**

1. <span class="s1">Go to </span>**Realm Settings &gt; Email**
2. Enter your SMTP configuration:
    
    
    - Host
    - Port
    - From address
    - Username/password
3. <span class="s1">Click </span>**Test Connection**
4. Click <span class="s1">**Save**</span>

[![image.png](https://docs.elest.io/uploads/images/gallery/2025-06/scaled-1680-/zTMimage.png)](https://docs.elest.io/uploads/images/gallery/2025-06/zTMimage.png)

#### **Enable “Forgot Password” Option**

1. <span class="s1">Go to </span>**Authentication &gt; Flows &gt; Browser**
2. Ensure <span class="s1">**Reset Credentials**</span> subflow is present
3. <span class="s1">Under </span>**Realm Settings &gt; Login**<span class="s1">, enable:</span>

- - **Forgot Password**
    - **Email as Username**<span class="s1"> (optional)</span>

[![image.png](https://docs.elest.io/uploads/images/gallery/2025-06/scaled-1680-/7rsimage.png)](https://docs.elest.io/uploads/images/gallery/2025-06/7rsimage.png)

#### **Trigger Reset Link (User Side)**

Users can go to the login page, click <span class="s2">**Forgot Password**</span>, and receive a reset link via email.

## **Required Permissions**

- Admin Console: Must have <span class="s1">manage-users</span> role
- REST API: Token must have <span class="s1">manage-users</span> in the target realm

To assign via Admin Console:

```
Users > [admin-user] > Role Mappings > Realm Roles > Add 'manage-users'
```

## **Best Practices for Password Resets**

- **Always Use Temporary Passwords for Manual Resets:** For admin-initiated resets, mark passwords as <span class="s2">temporary</span> to enforce user re-entry.
- **Secure SMTP Configuration:** Always use TLS/SSL for SMTP and avoid using free/public SMTP providers in production.
- **Limit Password Reset Frequency:** <span class="s3">Use brute-force protection under </span>**Realm Settings &gt; Security Defenses &gt; Brute Force Detection**<span class="s3">.</span>
- **Log and Audit Password Resets:** Enable <span class="s4">**Events &gt; Settings**</span> to log password reset events and maintain an audit trail.
- **Inform Users of Security Practices:** Add disclaimers to reset emails and verify request intent using short-lived links.

## **Common Issues and Troubleshooting**

<table border="1" id="bkmrk-issue-possible-cause" style="border-collapse: collapse; border-color: rgb(0, 0, 0);"><thead><tr><th style="border-color: rgb(0, 0, 0);">**Issue**

</th><th style="border-color: rgb(0, 0, 0);">**Possible Cause**

</th><th style="border-color: rgb(0, 0, 0);">**Solution**

</th></tr></thead><tbody><tr><td style="border-color: rgb(0, 0, 0);">Password reset link not received

</td><td style="border-color: rgb(0, 0, 0);">SMTP not configured or invalid

</td><td style="border-color: rgb(0, 0, 0);">Set up SMTP under Realm Settings &gt; Email

</td></tr><tr><td style="border-color: rgb(0, 0, 0);">Reset link expired

</td><td style="border-color: rgb(0, 0, 0);">Time limit exceeded

</td><td style="border-color: rgb(0, 0, 0);">Increase <span class="s1">**Reset Link Lifespan**</span> under Realm Settings &gt; Tokens

</td></tr><tr><td style="border-color: rgb(0, 0, 0);">User not prompted to change password

</td><td style="border-color: rgb(0, 0, 0);">Password not marked as temporary

</td><td style="border-color: rgb(0, 0, 0);">Enable <span class="s1">temporary: true</span> or configure as required action

</td></tr><tr><td style="border-color: rgb(0, 0, 0);">REST API returns <span class="s1">403 Forbidden</span>

</td><td style="border-color: rgb(0, 0, 0);">Missing permissions

</td><td style="border-color: rgb(0, 0, 0);">Ensure admin token has <span class="s1">manage-users</span> role

</td></tr><tr><td style="border-color: rgb(0, 0, 0);">User not found<span class="s1"> error</span>

</td><td style="border-color: rgb(0, 0, 0);">Wrong realm or username

</td><td style="border-color: rgb(0, 0, 0);">Confirm realm and check <span class="s1">Users &gt; View all users</span>

</td></tr></tbody></table>