tomcat 1 min read by 82 comments

What is Tomcat default administrator password ?

Is there or what is the default administrator user and password for Tomcat?

Tested :

  1. Tomcat 8.0.30
  2. Tomcat 7.0.67
  3. Tomcat 6.0.44

Article update history

  1. Updated 03/02/2016 : Add support for Tomcat 7 and 8.
  2. Updated 08/04/2011 : Update article.

1. Tomcat 7 and Tomcat 8

Tomcat users are defined in the file – $TOMCAT_HOME/conf/tomcat-users.xml, by default, there is NO user, it means no one can access the Tomcat manager page.

To enable users to access the Tomcat manager page, add a user as the role manager-gui.

$TOMCAT_HOME/conf/tomcat-users.xml (Original)

<tomcat-users>
<!--
  <role rolename="tomcat"/>
  <role rolename="role1"/>
  <user username="tomcat" password="tomcat" roles="tomcat"/>
  <user username="both" password="tomcat" roles="tomcat,role1"/>
  <user username="role1" password="tomcat" roles="role1"/>
-->
</tomcat-users>
$TOMCAT_HOME/conf/tomcat-users.xml (Updated)

<tomcat-users>
<!--
  <role rolename="tomcat"/>
  <role rolename="role1"/>
  <user username="tomcat" password="tomcat" roles="tomcat"/>
  <user username="both" password="tomcat" roles="tomcat,role1"/>
  <user username="role1" password="tomcat" roles="role1"/>
-->

	<role rolename="manager-gui"/>
	<user username="admin" password="admin" roles="manager-gui"/>

</tomcat-users>

Saved it and restart Tomcat, now you should able to access the default manager page (http://localhost:8080/manager) with user = “admin” and password = “admin”

Note
Please refer to this official Tomcat Manager App HOW-TO

2. Tomcat 6

For Tomcat 6, add a user as the role manager

$TOMCAT_HOME/conf/tomcat-users.xml (Updated)

<tomcat-users>

  <role rolename="manager"/>
  <user username="admin" password="admin" roles="manager"/>

</tomcat-users>
Note
This “manager” role is deprecated, and removed since Tomcat 7.

References

  1. Tomcat Manager App HOW-TO
  2. Maven – deploy web application to Tomcat

82 comments on “What is Tomcat default administrator password ?”

  2. Hello, I’m using tomcat 7 can anybody tell will it for work if I use the above method if not then what I can do to gain access as in the NOTE box it’s mentioned that manager role is deprecated.

    Reply

  3. i installed tomcat .when i open the tomcat-users.xml in command prompt i entered role rolename =”manager-gui” and below lines as you mentioned .then i saved file and closed it . when i go to manager webapp in browser it ask password and username , i entered the both by tomcat-users.xml file.but it doesn’t go to manager app , i get asked to enter password and username again and again

    Reply

  5. Do we need to restart tomcat to have it read the config file?

    Reply

  7. If you are trying to edit the xml content and it says you don’t have access because you aren’t and administrator, try opening the tomcat-users.xml like usual except run your text editor as an administrator

    Reply

  9. When i save then is give a message Access denied means unable to save……what to do tell me

    Reply

  10. hmm not posting
    role rolename=”manager-gui”
    role rolename=”admin-gui”
    user username=”admin” password=”admin” roles=”admin-gui, manager-gui”

    Reply

  11. Hi
    still struggling with it. spend few days on internet but still no luck
    is there a way to troubleshoot?
    my OS
    Windows
    my Tomcat is:
    Apache Tomcat/8.0.14
    my tomcat-users.xml:

    in my context.xml locking to local host is commented out
    in my server.xml following uncommented
    <Resource name="UserDatabase" auth="Container"
    .
    and
    <Realm className="org.apache.catalina.realm.LockOutRealm"
    .
    by one of suggestions created
    D:Tomcat80_4confCatalinalocalhostmanager.xml

    still getting 401

    appreciate any suggestion

    Regards

    Reply

  18. Hi !. I am writing you from Córdoba, Argentina. I am placing the same Xml Content in the tomcat-users file and I am still being rejected and get a 401 invalid credentials or unauthorized… I am under tomcat 7… Is there any other thing to configure in order to get into the manager console and deploy an app ?.
    Thankx

    Reply

    1. Did you restart the server after adding the new users?

      Reply

  20. As after above code I was still note able to get my Application Manager/ App manager Then Change the role

    so, can also set this code as (this below code worked for me)

    manager-gui — Access to the HTML interface.

    manager-status — Access to the “Server Status” page only.

    manager-script — Access to the tools-friendly plain text interface that is described in this document, and to the “Server Status” page.

    manager-jmx — Access to JMX proxy interface and to the “Server Status” page.

    Reply

  24. I installed tomcat in my Virtual Private Server in godaddy. Now I tried to access to Tomcat Host Manager using url: http://myServerIP:8080
    But I dont know the username and password for the same. How to get the username and password to login to host manager? Is there any default password.? Please help. I’m in real trouble.

    Reply

  25. As you said I added few users that’s working fine but up to how many maximum users i can add for tomcat manager to log in.

    Reply

  26. <!–

    –>

    note:replace the entire text except this (note) USERNAME:tomcat PASSWORD:s3cret

    Reply

    1. Hi,
      My name is Skender Kollcaku.
      here is the xml I saved with the Vi editor under Debian:

      <!–

      –>

      Hope it helps you!
      Sk

      Reply

      4. it worked – Thanks . the key is will not work – will work

        Reply

  27. try this ..its working for me
    replace entire file ..
    i have windows 7 ..apache 7.

    Reply

    3. Yes this helped me to as manager alone would not load, so changed to rolename=manager-gui

      Reply

  30. thinks a lot for all your tips, but i still have a problem
    ———————————————————-

    403 Access Denied

    You are not authorized to view this page.

    If you have already configured the Manager application to allow access and you have used your browsers back button, used a saved book-mark or similar then you may have triggered the cross-site request forgery (CSRF) protection that has been enabled for the HTML interface of the Manager application. You will need to reset this protection by returning to the main Manager page. Once you return to this page, you will be able to continue using the Manager appliction’s HTML interface normally. If you continue to see this access denied message, check that you have the necessary permissions to access this application.

    If you have not changed any configuration files, please examine the file conf/tomcat-users.xml in your installation. That file must contain the credentials to let you use this webapp.

    For example, to add the manager-gui role to a user named tomcat with a password of s3cret, add the following to the config file listed above.

    Reply

    1. when i am updating xml file. it show an error message, telling that access to tomcat-user.xml was denied. pls tell, why it is happening?

      Reply

  33. It’s nearly impossible to find educated people for this topic, however, you seem like you know what you’re talking about!
    Thanks

    Reply

  34. mkyong thanx for a wonderful help, here is the one i tried.

    Open in notepad, and just erase everything you have in tomcat-users.xml file and paste these lines.

     
<?xml version='1.0' encoding='cp1252'?>
<tomcat-users>
  <role rolename="manager-gui"/>
  <user username="tomcat" password="s3cret" roles="manager-gui"/>
</tomcat-users>

    hope it will work 🙂

    Reply

    1. robert thank you, finally this worked for me.

      Reply

  35. here are the lines. something went wrong earlier.

    Open in notepad, and just erase everything you have in tomcat-users.xml file and paste these lines.

    hope it will work 🙂

    Reply

  36. mkyong thanx for a wonderful help, here is the one i tried.

    Open in notepad, and just erase everything you have in tomcat-users.xml file and paste these lines.

    save the file, restart it, i hope it will work 🙂

    Reply

  37. user is tomcat
    password is password
    this line xml comments sometime your command chainging a cmment using good for programer notepad is good one or other highlighters not using a word or notepad

    Reply

  40. how to activating/login tomcat6 using ssh ?

    if i try to login “ssh tomcat6@localhost”, the sys asking password, but i don’t know what the default password. if that must be set, please help to set the password.

    i’am use Ubuntu Desktop 12.04

    Reply

    1. tomcat 7 username and password :

      C:\Tomcat 7.0\conf open in notepad => “tomcat-users.xml”

      Add following lines in above file :-

      <tomcat-users>
     <role rolename="manager-gui"/>
     <user username="admin" password="" roles="manager-gui"/>

     <role rolename="admin-gui"/>
     <user username="tomcat" password="s3cret" roles="admin-gui"/>        
 </tomcat-users>

      **Note :

      “admin-gui” -> Username & Password – Do not Change.
      “manager-gui” -> you can change user name & password for this only. [Here password is not given]

      Reply

  43. Hi,
    When I tried to edit the tomcat-users.xml file and save, it is showing a warning that “Access is denied” or “Please check whether if this file is opened in another program”

    Why is this happening?

    Reply

    1. You can issue the 

      ls -l

      command. Check the file permissions in the first column in the list. if it is have edit access then you can edit it otherwise use

       chmod 777 tomcat-users.xml

      .

      Reply

  46. hi ,

    i am following the steps “http://craeser.wordpress.com/2010/07/21/java-tomcat-security-protected-example/#comment-418”. But value is not picking from tomcat-user.xml file.

    Reply

  47. Hi, nice tip for accessing the Status and Tomcat Manager pages though I am having the same problem when I try to access the Status or Tomcat Manager pages;

    HTTP Status 403 – Access to the requested resource has been denied

    I have the role set as admin and manager I am flat out of ideas any help would be wonderful, thanks 🙂

    Reply

      1. Just type in, manager-gui do not put ‘– Allows access to the html interface’ in 🙂

        Reply

  49. Hello, I’ve modified the file as per your instructions but while it will accept the user and password when I enter the TomCat Manager it will give me

    HTTP Status 403 – Access to the requested resource has been denied

    type Status report

    message Access to the requested resource has been denied

    description Access to the specified resource (Access to the requested resource has been denied) has been forbidden.

    Reply

  50. I was unable to access the server status under Tomcat 7 with the configuration given in example. I had to add the “manager-gui” role to do so:
    Reply

  51. nice !!!

    kick start 4 novice , without tedious documentation
    /etc/tomcat6/tomcat-users.xml debian 6 and debian based OS. N freeBSD also 🙂

    become a server administrator keep going

    Reply

  53. Thank you vary much
    this helped alot
    this was very quick n to the point.

    Reply

  54. Yes, thank you very much. Was able to get the administration and manager functioning nicely after reading your short tutorial.

    Reply

Leave a Comment

Your email address will not be published. Required fields are marked *