Quickly Reset the NukeViet Root Admin Password

Updated: May 2026

Starting with version 4.x, NukeViet no longer uses standard MD5 password hashing, so changing a password to an MD5 hash in phpmyadmin is completely pointless and will not work. You must use one of the following 2 methods instead.

Here are 2 ways to change a password in NukeViet

Method 1:

This method involves modifying the code, but remember to remove the added code afterward to prevent it from being exploited.

First, open the mainfile.php file in the includes directory.
Next, paste the following code at the very end of this file.

$username = ‘admin’; $password = $crypt->hash ( trim ( ‘123456’ ) ); if( $db->exec( “UPDATE ” . NV_USERS_GLOBALTABLE . ” SET password=” . $db->quote( $password ) . ” WHERE md5username=’” . nv_md5safe( trim( $username ) ) . ”’” ) ) { die( ‘Reset password success. Delete this file immediately’ ); } else { die( ‘No Reset password’ ); } Here, $username = ‘admin‘; is the admin account $password = $crypt->hash ( trim ( ‘123456‘ ) ); sets the password to: 123456

Next, visit your site, and you will see the message “Reset password success. Delete this file immediately”, which means you have successfully changed the password.
Method 2:
This method is safer because the tool was written by the NukeViet developers. To use this method, follow these steps.

Download the tool from: https://github.com/nukeviet/set-password/archive/master.zip\ Extract the archive and upload the resulting file to your hosting server (alongside index.php, mainfile.php,…)
Edit the contents of this file. Note the lines that need to be changed.
$username = ‘admin‘ replace admin with the super administrator account whose password you want to change.
$newpassword = ‘123456‘; replace 123456 with your password.
$client_ip = ‘113.190.237.5‘; replace the IP address with the IP address you use to access the website. To find your internet IP address, visit http://ipaddress.com/ to see the IP address you are using to access the internet.
$sitekey = ‘sitekey-sitekey-sitekey-sitekey‘; replace this with the sitekey found in config.php under the variable $global_config[‘sitekey’]
Then save the file and visit your website at a URL like this: http://domain.com/set-password.php

After visiting that URL, you will see the message “Reset password success. Delete this file immediately”, which means you have successfully changed the password. Now delete the set-password.php file.
Good luck!

Related Articles

• Genius Olympiad 2017–2022 Awards Roundup for Gia Định High School