GeoServer Admin Password: The Guide to Reset, Change, and Find users.properties

If you’ve ever typed admin / geoserver into the GeoServer login page, you’re in the right place. Maybe you’re trying to tighten security and change the default password. Maybe you’ve completely blanked on what you set six months ago. Or maybe you already know you need to edit users.properties but can’t figure out where that file actually lives on your machine.

Whatever brought you here, this guide has you covered. We’ll walk through three real-world scenarios: you can still log in, you’re locked out, or you made changes but they just won’t stick. And we’ll pay special attention to the one thing most tutorials gloss over—the actual location of your GeoServer data directory depending on whether you’re using the built-in Jetty server or an external Tomcat deployment.

Scenario 1: You Can Still Log In (Change Your Password the Easy Way)

If you still have access to the web admin interface at http://localhost:8080/geoserver/web, this is the simplest path—and the one I recommend you take first.

1. Log in with your current credentials.
2. In the left-hand menu, find the Security section.
3. Click on Users, Groups, Roles, then switch to the Users/Groups tab.
4. Locate the admin user, click its name to open the edit screen.
5. Enter your new password in the Password and Confirm Password fields.
6. Hit Save.

That’s it. GeoServer will encrypt the new password behind the scenes and store it in the security configuration. No manual hashing, no digging through files. This is the recommended way to change your admin password in any environment.

One small heads-up: right after saving, you might need to log out and log back in for the change to take full effect. In the vast majority of cases, you don’t need to restart the server. But if you notice anything off, a quick restart never hurts.

While you’re on this screen, you can also create additional users and assign them specific roles—super handy if you need to hand off limited admin access to someone else without sharing the master password.

Scenario 2: You’re Completely Locked Out (Reset the Password from the File System)

Forgot your password, or something got corrupted? No worries. You’ll just need to modify one configuration file directly. But first, you have to find your GeoServer Data Directory. This is the step that trips up most people, so let’s break it down by how you installed GeoServer.

Finding the Data Directory

If you’re using the platform-independent binary (the “Jetty” package you unzipped):
The data directory is almost always right inside your GeoServer installation folder. If you followed typical instructions, you’ll see a folder called data_dir next to bin, logs, and webapps. For example:

C:\Users\yourname\GeoServer 2.27.2\data_dir

If you set a custom GEOSERVER_DATA_DIR environment variable or tweaked the startup.bat script, then that’s where your data lives. Open startup.bat in a text editor and look for a line like set GEOSERVER_DATA_DIR=... to get the exact path.

If you deployed GeoServer on Tomcat (war file):
The data directory is separate from the webapps folder and won’t just be sitting inside it. The most reliable ways to find it are:

• Check the Tomcat console output when GeoServer starts up—you’ll usually see a line showing -DGEOSERVER_DATA_DIR=....
• Look in the most common default locations:
  C:\Users\yourname\.geoserver (Windows)
  /home/yourname/.geoserver (Linux)
  /Users/yourname/.geoserver (macOS)
  Or inside the Tomcat directory itself, like tomcat/data/geoserver.
• If all else fails, search your entire drive for a file named global.xml; it lives inside the data directory.

Once you’ve located the data directory, the rest is the same regardless of your setup.

Editing the Password File

Navigate to:

security/usergroup/default/

Inside, you’ll find users.properties. Open it with any plain-text editor (Notepad, VS Code, etc.). You’ll see something like:

admin=geoserver,ROLE_ADMINISTRATOR

The format is username=password,role.

Now you have two options for resetting the password: a quick plain-text method, or a more secure encrypted approach.

Option A: Plain-text reset (fast and fine for dev/staging environments)

Just replace the old password with your new one:

admin=MyN3wP@ssword,ROLE_ADMINISTRATOR

Save the file and restart GeoServer. On startup, GeoServer will detect the plain-text password, hash it automatically, and rewrite the file. Your new password will then be ready to use. This is by far the easiest method for local development machines—just be aware the password is temporarily readable on disk until the server starts.

Option B: Generate an encrypted password manually (recommended for production)

If you’d rather not rely on auto-encryption, or you’re working in a production setting, use GeoServer’s built-in tool to create a secure digest.

1. Open a terminal and navigate to your GeoServer installation’s bin directory (or, if you’re on Tomcat, find the WEB-INF/lib folder).
2. Run the following command (requires Java):

   java -cp "../webapps/geoserver/WEB-INF/lib/*" org.geoserver.security.password.GeoServerDigestPasswordEncoder YourNewPassword

   For Jetty standalone, you might be able to run a script if it exists:

   ./password.sh YourNewPassword   # Linux/macOS
   password.bat YourNewPassword    # Windows

3. The output will look something like crypt1:K5xL6RcUjZ+3Xf4p. That’s your encrypted string.
4. Replace the password portion in users.properties with this full string, keeping the prefix:

   admin=crypt1:K5xL6RcUjZ+3Xf4p,ROLE_ADMINISTRATOR

5. Save the file.

Either way you choose, the final step is the same: restart GeoServer. Without a restart, nothing will change.

Scenario 3: You Made the Change but It’s Not Working—The Reboot Trap

This one comes up constantly. You edit users.properties, save it, refresh the login page, and… the old password still works. Or the new one doesn’t.

Here’s why: GeoServer loads the user configuration when it starts up and holds that data in memory. Changing the file while the server is running will not have any effect until the service restarts. There’s no dynamic reload for the core authentication file unless you’ve explicitly set up something like an external authentication provider.

So after any edit to users.properties, you must restart:

• For the Jetty standalone, close the terminal window and run startup.bat again (or use shutdown.bat).
• For Tomcat, restart the Tomcat service. I also recommend clearing the work directory just to be safe.
• If you see absolutely no change after a restart, double-check that you’re editing the correct users.properties—it’s shockingly common to have multiple data directories from older installations lying around.

A note for advanced setups: if you’ve configured GeoServer to use LDAP or another external identity provider, then modifying the built-in user file won’t do anything at all. You’ll need to manage passwords through the admin interface under the Authentication section, not by editing a properties file.

Quick Troubleshooting Checklist

If you’ve followed these steps and still can’t log in, run through this list before you get frustrated:

1. Are you sure you’re editing the right users.properties? Kill any secondary GeoServer processes, then search your system for multiple occurrences of the file.
2. Did you accidentally delete the role? The role ROLE_ADMINISTRATOR must stay. The line should read admin=password,ROLE_ADMINISTRATOR with no extra spaces in the wrong places.
3. Is the username exactly admin? It’s case-sensitive—Admin won’t work.
4. Check the logs. Open the terminal where GeoServer is running, or look at logs/geoserver.log. Any authentication error will usually be spelled out clearly.
5. Nuclear option: If nothing else works, back up the entire security folder inside your data directory, then delete it. When you restart GeoServer, it will regenerate a fresh security configuration with the default admin / geoserver credentials. Note that any custom users, roles, and permissions you created will be wiped out, so treat this as a last resort.

Whether you need to tighten security, recover from a forgotten password, or simply figure out which directory holds that elusive users.properties file, you now have a clear path forward. GeoServer’s password management isn’t complicated once you know where to look—and now you do. No more reinstalling out of desperation.