I'm using GeoServer 2.5.1 and I want to change my default Master Password as is suggested by GeoServer itself when I log in:

The master password for this server has not been changed from the default. It is highly recommended that you change it now. Change it

The Change it link leads me to the Change password form, though I need the default Master Password for this. According to this doc, I'm supposed to find it it at security/masterpw.info, however the only files I find there are masterpw.digest and masterpw.xml. I've tried a bunch of sequences that looked like pws from these files and a file passwd in security/masterpw/default but all I am ever getting is

org.geoserver.security.validation.MasterPasswordChangeException: Current master password invalid

This is reproducible on two different servers and plenty of fresh installations. Am I overseeing something? How can I change my masterpw without masterpw.info?

2 Answers 2


If you can log into the Geoserver UI with the admin account, you should be able to access the Passwords link under the Security tab on the left nav. One of the options here is to pipe the master password out to a file, as well as reset it.

If you're unable to login, you should be able to reset the admin's password from encrypted to a plaintext one, temporarily: In /data/security/usergroup/default/users.xml, change

<user enabled="true" name="admin" password="digest1:D9miJH/hVgfxZJscMafEtbt...JOSV4POi55PQI4tw"/>


<user enabled="true" name="admin" password="plain:new-password-here"/>

Then, once you are able to login, you can go into your account, update your password and save it, which will save it back in an encrypted digest form.

  • 3
    For those that come across this post, in v2.5.2 of Geoserver, changes made through the GUI, get saved to these config files automatically. That is to say there is no setting to "pipe the master password out to a file".
    – alexkb
    Commented Oct 6, 2014 at 7:26
  • I'm still confused by this, there is no "masterpw.info" plaintext file generated by default, so I can't change the master password nor access it by using the available encrypted passwd file (this defeats the purpose of a master password).
    – ideamotor
    Commented Nov 5, 2015 at 21:41
  • 1
    @ideamotor FYI, the default password is geoserver, see my answer for some more info.
    – Stijn
    Commented Mar 14, 2018 at 17:09
  • This answer is about the admin account, the question was about the root account (called "master"). It's confusing and maybe just a change in history but hopefully my comment will prevent you, dear reader, from getting more confused than you already are. Commented Mar 27 at 8:41

The documentation is outdated/wrong.

It's possible to dump the master password by navigating to Security > Passwords and clicking the Master password forgotten ? link. Turns out that the default password is the same as for the admin account: geoserver

  • So this means there is no such thing as a master password?
    – Honeybear
    Commented Mar 16, 2018 at 10:16
  • I'm not sure what you mean. The master password is a thing, although it's a bit odd that it can be decrypted.
    – Stijn
    Commented Mar 16, 2018 at 10:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.