I keep getting an error "The configuration file now needs a secret passphrase" after installation of phpmyadmin. I have set the passphrase and also followed the instruction presented on https://serverfault.com/questions/291490/phpmyadmin-not-allowing-users-to-log-on but it doesn't seems to be working. I am using AMI and chcked the owner and permissions as well. Please kindly help.

15 Answers 15


This might help, https://wiki.archlinux.org/index.php/PhpMyAdmin#Add_blowfish_secret_passphrase

If you see the following error message at the bottom of the page when you first log in to /phpmyadmin (using a previously setup MySQL username and password) :

ERROR: The configuration file now needs a secret passphrase (blowfish_secret)  

You need to add a blowfish password to the phpMyAdmin's config file. Edit /etc/webapps/phpmyadmin/config.inc.php and insert a random blowfish "password" in the line

$cfg['blowfish_secret'] = ; /* YOU MUST FILL IN THIS FOR COOKIE AUTH! */  

It should now look something like this:

$cfg['blowfish_secret'] = 'qtdRoGmbc9{8IZr323xYcSN]0s)r$9b_JUnb{~Xz'; /* YOU MUST FILL IN THIS FOR COOKIE AUTH! */  

This all assumes you've already properly created the config file,

cp config.sample.inc.php config.inc.php
  • As I said,I have already set the passphrase and still not working.
    – jax
    Commented Jul 25, 2014 at 22:13
  • 1
    Perhaps the config file you've edited isn't the active one? Because the error indicates that the passphrase is not set. Commented Jul 26, 2014 at 2:18
  • 2
    I have this same problem...I changed my config.sample.inc.php file to config.inc.php and added the mentioned $cfg['blowfish_secret'] = 'qtdRoGmbc9{8IZr323xYcSN]0s)r$9b_JUnb{~Xz'; setting to it but phpMyAdmin index page still complains that it is missing! If some chance it is loading a different file, then I do not know where or why the file is? Any ideas anyone who had this problem before?
    – JasonDavis
    Commented Mar 7, 2015 at 1:19
  • 1
    @jasondavis check the other answer; you might have a permissions issue and need to change the ownership / group of your phpMyAdmin config folder. Commented Mar 8, 2015 at 0:05
  • 2
    You can use the "Secret Generator" at question-defense.com/tools/phpmyadmin-blowfish-secret-generator to get a random code that should work. Its linked in a pager from user16081-JoeT post. Then follow his instructions.
    – WebLuke
    Commented Jul 3, 2015 at 23:04

I was also getting the error The configuration file now needs a secret passphrase (blowfish_secret) when the configuration file had $cfg['blowfish_secret'] set. I'm using CentOS v6 and I installed PHPMyAdmin from the EPEL repo using yum. I setup nginx to host PHPMyAdmin and the PHPMyAdmin package (by default) is setup to work with Apache. The configuration file is located at /etc/phpMyAdmin/config.inc.php (you can check CONFIG_DIR in libraries/vendor_config.php to find where your config file is located) and if you notice, the user is root and the group is apache for the file and directory. This causes PHPMyAdmin to not be able to read the configuration file. To fix this problem, use chown to change the group to the one that is running your webserver (in my case, the group is nginx). You will need to change the owner for both the directory AND configuration file (as shown below).

chown -R root.nginx /etc/phpMyAdmin/

Note that you may need to do this again if PHPMyAdmin is updated. You may also have further problems with permissions if SELinux is enabled.

  • Comments in /etc/phpmyadmin/config.inc.php: ` * NOTE: do not add security sensitive data to this file (like passwords) * unless you really know what you're doing. If you do, any user that can * run PHP or CGI on your webserver will be able to read them. If you still * want to do this, make sure to properly secure the access to this file * (also on the filesystem level). */` Commented Feb 15, 2016 at 19:35
  • Below that, it has this line: include('/var/lib/phpmyadmin/blowfish_secret.inc.php'); So I went there and changed that file's group to my webserver user. It works, but doesn't seem any more secure than putting the password in /etc/phpmyadmin/config.inc.php. I guess maybe PHP can't be run there? It did fix the issue, though. So I guess I'll cross the hack attack bridge when I get to it. Commented Feb 15, 2016 at 19:40
  • The default location under the CONFIG_DIR is ./config/config.inc.php. Since I have this file outside of this directory so I can swap versions easier, I just needed to create a symlink for this file to my location and the message went away for me. ln -s ../../../config.inc.php config.inc.php
    – MECU
    Commented Apr 4, 2016 at 19:57
  • 2
    +1 For needing to set permissions on the /etc/phpMyAdmin directory, and not just the config.inc.php file in it.
    – jxmallett
    Commented Sep 26, 2016 at 0:13
  • +1 for the comment about doing this again after updating. On CentOS when php-fpm is updated it resets the directory group to apache.
    – palehorse
    Commented Mar 30, 2021 at 15:41

The latest version of phpmyadmin does not create the config file after installation. There is an example config file available and an actual default config file deeper in the folder tree.

Note that the blowfish secret must be exactly 32 characters in length else it will not be applied.

Copy the example file to create the actual used file that overrides defaults. The directory shown below is just an example, therefore use the directory/path for your phpmyadmin installation that applies.

cp /usr/share/phpmyadmin/config.sample.inc.php /usr/share/phpmyadmin/config.inc.php

At the top of the file is the blowfish variable that needs to be set. Add 32 random characters to the variable's value and then save the file.

$cfg['blowfish_secret'] = 'KLS$vbc91Lkja$vc@opGbxA278EWopdc';

I did not read anyone mentioning the 32 character rule in this thread. Perhaps that was the issue for the OP.

  • This sorted me out. Thanks Commented Mar 29, 2020 at 3:24
  • Worked for me as well.
    – Raymond
    Commented Oct 28, 2022 at 16:15

I had

define('CONFIG_DIR', '/etc/phpmyadmin'); 

in /usr/share/phpmyadmin/libraries/vendor_config.php.

It should be:

define('CONFIG_DIR', '/etc/phpmyadmin/'); 

(forward slash added)


In my case, I upgraded PHPMyAdmin manually because the version in the repo did not behave well with PHP 7.2. I followed all the steps online, but had made a mistake in /usr/share/phpmyadmin/libraries/vendor_config.php.

The line: define('CONFIG_DIR', '/etc/phpmyadmin/'); was missing an / at the end. I found this out by manually editing libraries/classes/Config.php and at the beginning of function load($source) I did a die($source). There I saw that the config source was incorrect.


In addition to checking permissions are executable for the http (web server) group, it's worth checking that the 'open_basedir' entry in php.ini includes the directory where config.inc.php is located if it is set. This cured this issue for me.


Go to phpmyadmin folder >search for 'lint.php' and set the ='require_once 'libraries/config.inc.php';

It will definetly solve your problem.

If It solve your problem then thanks to me.


Follow these steps:

1) Go to /etc/httpd/conf.d/phpmyadmin.conf

  • (check path of phpMyAdmin in directory tag)

2) Go to /usr/share/phpmyadmin, open conf.inc.php

3) Add value for blowfish_secret, like -

$cfg['blowfish_secret'] = 'mrgQxxk8C-y}U7ji2BO9o5jLf}Qhe-BI[~6SUa';/* YOU MUST FILL IN THIS FOR COOKIE AUTH! */

4) Save & exit.

5) Clear browser cache

6) Try to access with url :http://yourserver.com/phpmyadmin/index.php


Just want to share this. put

$cfg['blowfish_secret'] = 'fill this up';

Go to phpmyadmin folder and search for lint.php

and set the

require_once 'common.inc.php';

If you have edited the file here : /usr/share/phpmyadmin/config.inc.php

And problem not solve, there is a possibility that you are editing wrong file. if you run whereis phpmyadmin -l that should give you list of phpmyadmin location on the server.

Why I said you may be editing wrong file is that if you install your phpmyadmin in var/www/phpmyadmin or var/www/html/phpmyadmin this is where you need to edit the phpmyadmin/config.sample.inc.php.

So try this:

$ cd var/www/html/phpmyadmin
$ cp config.sample.inc.php config.inc.php

Edit this in your way and logout and login phpmyadmin you should be fine.


For me config.inc.php file is missing.

Copy it from config.sample.inc.php or create a new file:


/******** The Solution *******/
$cfg['blowfish_secret'] = 'type a 32 char passphrase'; 

$i = 0;
$cfg['Servers'][$i]['auth_type'] = 'cookie';
$cfg['Servers'][$i]['host'] = 'localhost';
$cfg['Servers'][$i]['compress'] = false;
$cfg['Servers'][$i]['AllowNoPassword'] = false;
$cfg['UploadDir'] = '';
$cfg['SaveDir'] = '';

Then, refresh PhpMyAdmin page twice because it is a cookie issue.


Adding password with 32 symbols inside brackets $cfg['blowfish_secret'] = ''; helped me for another file inside /usr/share/phpmyadmin/libraries/config.default.php

Using debian 9 + ispconfig, manually installed phpmyadmin


In my case it was owner/permissions issue, because I manually created symlink in one of my primary websites to point to /usr/share/phpmyadmin/ so I could access phpMyAdmin from FQDN https://myserver.mydomain.com/changedphpmyadmin instead via IP only. But doing so also changed web user; browsing via IP is different than via FQDN, if this is not default domain.

So in my case the web user of my FQDN could not read /var/lib/phpmyadmin/blowfish_secret.inc.php, so I simply changed owner of this file from root:www-data to web1:client1 in my case. Then test and reload nginx:

chown web1:client1 /var/lib/phpmyadmin/blowfish_secret.inc.php
nginx -t
systemctl reload nginx
  • 1
    There should have been no need to reload nginx; it has nothing to do with executing PHP code.
    – womble
    Commented Oct 4, 2019 at 4:26

I ensured the correct webuser was set for /var/lib/phpmyadmin when utilising phpmyadmin with virtualmin. I installed phpmyadmin manually so it could be accessed globally and not per virtualhost/domain. This /var/lib/phpmyadmin folder contained blowfish_secret.inc.php which was created via the installer I assume.


For those who tried:

"Set 'blowfish_secret' correctly in config.inc.php"

but not work!!!


Check the permission of the file config.inc.php, it should be 555 for reading and also executing, by this command:

sudo chmod -R 555 /etc/phpMyAdmin
  • -R: option, to grant permission for all files under `/etc/phpMyAdmin
  • 1st 5: Read + Execute permission for the User.
  • 2st 5: Read + Execute permission for the Group.
  • 3st 5: Read + Execute permission for the others. (just for sure)
  • 1
    It does not need execute permissions. Commented Dec 20, 2022 at 11:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .