Updated: 28 September 2026 · Applies to: cPanel & WHM 138 (WHM, root access)
After a security incident, or when you take over a server, you may need to give every cPanel account a new password. As root, you can do it from the command line with the WHM API.
Change all passwords
Log in to the server as root over SSH and run:
umask 077
for user in $(awk -F': ' '{print $2}' /etc/trueuserdomains | sort -u); do
pass=$(openssl rand -base64 18)
if whmapi1 passwd user="$user" password="$pass" | grep -q 'result: 1'; then
echo "$user $pass" >> /root/new-cpanel-passwords.txt
else
echo "failed: $user" >&2
fi
done
The new passwords are saved in /root/new-cpanel-passwords.txt, readable only by root. Send each customer their new password securely, then remove the file.
Change one password
In WHM, open Account Functions › Password Modification, choose the account, enter a new password and click Change Password. From the command line: whmapi1 passwd user=USERNAME password='NEW-PASSWORD'.
Note: Changing the cPanel password does not change the passwords of the account's email, FTP or database users. Check those separately if they may be affected.
