Can an admin check passwords of registered users?

The user passwords are stored in one-way encription. Even looking at the database you can not know the password. This is a very basic privacy feature. Most users use the same password on multiple sites; imaging the potential risks for users if the administrator of the site can access to their passwords. You can intercept the password from and get access to it, but that is a really very bad practice. If I would know that a site where I’m registering is storing my password in a human readable way, or trying to intercept the password, I probably would notice to privacy protection goverment agency in my country, maybe not, but I would stop using that website for sure.

That being said, you, as admin, don’t need the password to access user profile or user data. The administrators have access to most of the profile fields directly in the admin area, and of course through database. New or custom fields in user profiles can be coded with or without admin access, that is totally up to you. So I don’t get the point to getting the users passwords.

Leave a Comment