It is also possible to set a master password for GeoServer. This password serves two purposes:
Protect access to the keystore
Protect access to the GeoServer Root account
By default, the master password is generated and stored in a file named security/masterpw.info using plain text. When upgrading from an existing GeoServer data directory (versions 2.1.x and lower), the algorithm attempts to figure out the password of a user with the role ROLE_ADMINISTRATOR. If such a password is found and the password length is 8 characters at minimum, GeoServer uses this password as master password. Again, the name of the chosen user is found in security/masterpw.info.
Warning The file security/masterpw.info is a security risk. The administrator should read this file and verify the master password by logging on GeoServer as the root user. On success, this file should be removed.