How to Change Odoo Database Master Password

The Odoo database master password (also called admin_passwd) is not the same as the admin user's login password. It's a separate credential that controls who can create, drop, backup, and restore databases through Odoo's database manager interface at /web/database/manager. If this is set to the default value or left blank, anyone who can reach your Odoo server can delete your entire database.

What Is the Master Password?

The master password protects the database management interface. With it, anyone can:

• Create new databases
• Delete existing databases
• Duplicate databases
• Restore databases from backup files
• Download full database backups

This is enormously powerful. The default master password on many Odoo installations is admin — trivially guessable. Changing it (or disabling the database manager entirely) is one of the first steps in Odoo security hardening.

How Odoo Stores the Master Password

The master password is stored in odoo.conf as the admin_passwd parameter. Since Odoo 13, if you set it as plaintext in the config file, Odoo hashes it on first use and replaces the plaintext with the hash. The hash format looks like:

$pbkdf2-sha512$25000$abc123...[long hash string]

When Odoo starts and finds an unhashed value, it automatically hashes and rewrites the config file. So even if you set it as plaintext, it won't stay plaintext after the first restart.

Method 1: Edit odoo.conf Directly

The simplest approach — set it as plaintext, let Odoo hash it on startup:

Native Install

# Edit the config file
sudo nano /etc/odoo/odoo.conf

# Find or add the admin_passwd line:
admin_passwd = your_strong_master_password_here

# Save and restart Odoo
sudo systemctl restart odoo

Docker

# Edit your config file (mounted into the container)
nano /opt/odoo/config/odoo.conf

# Add or update:
admin_passwd = your_strong_master_password_here

# Restart the container
docker compose restart odoo

After restart, Odoo hashes the value and rewrites the config. The next time you open the file, you'll see the hashed version instead of your plaintext password.

Method 2: Change via the Database Manager UI

1. Navigate to https://your-odoo.com/web/database/manager
2. Click Set Master Password (if visible) or the password change option
3. Enter the current master password
4. Enter and confirm the new master password
5. Click Continue

This method requires knowing the current master password. If you don't know it, use Method 1 (edit odoo.conf directly).

Method 3: Set via Shell (Pre-Hashing)

If you prefer not to have a plaintext password in the config even temporarily, pre-hash it:

# Generate the hash
python3 -c "
from passlib.context import CryptContext
ctx = CryptContext(schemes=['pbkdf2_sha512'])
print(ctx.hash('your_strong_master_password'))
"

Copy the output and paste it as the admin_passwd value in odoo.conf:

admin_passwd = $pbkdf2-sha512$25000$abc123...[paste full hash here]

Odoo recognizes the hash format and uses it directly without rehashing.

Choosing a Strong Master Password

Since the master password can destroy your entire database, treat it like a root password:

• At least 20 characters
• Mix of uppercase, lowercase, numbers, symbols
• Not related to your Odoo admin password
• Stored in a password manager, not just in the config file
• Rotated periodically and whenever a team member with access leaves

Generate a strong one with:

openssl rand -base64 32

Disabling the Database Manager Entirely (Recommended for Production)

If you run a single production database and don't need the database manager, disable it completely:

[options]
; Disable the database selector and manager
list_db = False

With list_db = False:

• The /web/database/manager URL returns 404
• The database selector at /web/database/selector is hidden
• Users can only log in to the specific database configured in db_name
• The master password becomes irrelevant (no manager to authenticate to)

This is the recommended configuration for single-database production deployments. There is no operational reason to have the database manager exposed on a production server.

Testing Your Master Password

After changing it, verify the new password works:

1. Navigate to /web/database/manager
2. Attempt an operation (e.g., view the backup option)
3. When prompted, enter the new master password
4. Confirm access is granted

If you get "Access denied," the hash in the config file may not have been read correctly. Check Odoo logs and verify the config file syntax.

Common Mistakes

Relationship to Admin User Password

To be completely clear:

• admin_passwd in odoo.conf = master password for the database manager at /web/database/manager
• Admin user password = the login password for the Odoo user named "admin" (or with admin rights), changed via Settings → Users or the shell method

These are completely independent. You can have a strong master password and a weak admin user password, or vice versa. Both must be secured. See our guide on resetting the Odoo admin user password.

How DeployMonkey Manages the Master Password

On DeployMonkey instances, the database manager is disabled (list_db = False) on all production configurations. Database operations — backups, restores, duplications — are performed through the DeployMonkey control panel using our own secure API, not through Odoo's database manager.

This means the master password attack surface is eliminated entirely. Odoo is configured to serve only your production database, with no database manager exposed.

Start a free instance with security-hardened defaults out of the box.

Frequently Asked Questions

What happens if I forget the master password?

Edit odoo.conf directly and set a new admin_passwd value. You have filesystem access to the server (or the mounted config file in Docker), so you can always reset it without knowing the current value. Restart Odoo after editing.

Is the master password stored securely?

Yes, as a PBKDF2-SHA512 hash after the first use. However, the hash is stored in a plaintext config file — anyone with read access to odoo.conf can see it. Protect the config file with appropriate filesystem permissions (readable only by the odoo user).

Can the master password be set per-database?

No. The master password is global across all databases on that Odoo instance. It's configured once in odoo.conf.

Does the master password protect against SQL injection?

No. The master password only protects the database manager UI. It does not affect SQL-level security. Database security is handled by PostgreSQL user permissions and proper application security. See our Odoo security guide for the full picture.