Fix self hosted n8n locked out on Railway

If your self hosted n8n locked out after an upgrade on Railway and the password reset email never works because you have no SMTP, you can either add SMTP credentials in Railway to let n8n send the reset link, or run a small Postgres change to set a new bcrypt password for the owner account and clear any reset tokens to get back in immediately.

Why this happens

When you upgrade n8n, user data remains in your Postgres database, but the built in password reset flow requires SMTP to send a reset link. On Railway many projects are deployed without SMTP, so the reset email never arrives. If the owner account is locked or you cannot reset via the UI, direct database access or enabling SMTP are the two reliable recovery routes.

Recover from self hosted n8n locked out

This section gives the Railway specific, safe sequence to regain owner access without waiting for email. Choose option A to add SMTP quickly, or option B to reset the owner password in Postgres. You will need your Railway Postgres connection string and access to your project environment variables.

Step by step fix

1. Grab your Railway Postgres URL. In Railway, open your project, click the Postgres plugin, then click "Connect" or "Settings" and copy the DATABASE_URL. It looks like: postgres://user:pass@host:5432/dbname.
2. Option A, quickest and safest: configure SMTP on Railway. In Railway go to Project Settings, click Variables, add these variables (example names n8n expects): N8N_SMTP_HOST, N8N_SMTP_PORT, N8N_SMTP_USER, N8N_SMTP_PASS, and optionally N8N_SMTP_FROM. Use a free Mailgun, SendGrid, or Mailtrap account for quick SMTP. Redeploy your service. Then use the n8n UI forgot password flow to send the reset email.
3. Option B, direct Postgres password reset. Use psql locally or Railway CLI to run SQL against your database. First find the owner row. Run:

psql "$DATABASE_URL" -c "SELECT id, email FROM public.users;"

1. Update the owner password with a bcrypt hash generated by Postgres pgcrypto. Many Railway Postgres instances allow the crypt() function. Replace [email protected] and NewPass123! with your email and a strong password.

psql "$DATABASE_URL" -c "UPDATE public.users SET password = crypt('NewPass123!', gen_salt('bf')) WHERE email = '[email protected]';"

1. Clear any reset token fields if they exist so the account is not blocked. Run both in case your schema uses camelCase or snake_case names.

psql "$DATABASE_URL" -c "UPDATE public.users SET \"passwordResetToken\" = NULL, \"passwordResetTokenExpires\" = NULL WHERE email = '[email protected]';"
psql "$DATABASE_URL" -c "UPDATE public.users SET password_reset_token = NULL, password_reset_expires = NULL WHERE email = '[email protected]';"

1. Restart your n8n Railway service or trigger a redeploy so the change is visible to the running app. Then log in at the n8n UI with the email and the new password.
2. If you cannot use crypt() because pgcrypto is not available, create a bcrypt hash locally and paste it directly into the password column. Generate a bcrypt string with any bcrypt tool or a small Node script, then run:

psql "$DATABASE_URL" -c "UPDATE public.users SET password = '' WHERE email = '[email protected]';"

n8n, Railway and login issue notes

• n8n nodes names to remember when rebuilding flows are HTTP Request and Code. This is not needed for recovery but useful after you regain access.
• If your deployment uses basic web protection, you may also have these env vars: N8N_BASIC_AUTH_ACTIVE, N8N_BASIC_AUTH_USER, N8N_BASIC_AUTH_PASSWORD. Those protect the UI but do not reset the n8n owner user.
• Railway redeploys when you change environment variables. After adding SMTP vars or changing secrets, force a redeploy from the Railway project page to make the new values active.
• There are community reports of this exact scenario, see threads about Railway hosted upgrades causing lockouts for more context: n8n community thread about Railway lockout and related forum report.

How to stop it happening again

• Always set SMTP environment variables on Railway before upgrading. Add them under Project Settings, Variables, using a reliable SMTP provider and test sending from the n8n UI under Settings, User settings if available.
• Keep a secondary admin account in n8n that you save in a password manager. Create a second owner or admin user and store credentials securely so you are not dependent on a single account.
• Take a quick DB backup before upgrades. Railway has a backup/export option or you can use pg_dump with the DATABASE_URL. That lets you roll back or extract a user row if needed.
• Consider enabling N8N_BASIC_AUTH for UI protection while you handle SMTP, but remember it is separate from n8n user accounts.

When to get help

If the Postgres schema on your instance differs and the SQL above fails, or if you cannot access the Railway database URL, stop and ask for support. Reach out on the n8n community forum with your Railway error message and a minimal description, or open Railway support if the project is inaccessible. If you are uncomfortable running SQL against your production database, get a developer to assist so you avoid accidental data loss.

After you regain access, re-enable proper email by adding N8N_SMTP_HOST and related vars, test the forgot password flow, and then rotate the admin password. For deeper debugging of nodes and flows after the upgrade, see related guides like our post on Fix n8n nodes handling data stream issues.

If you want to learn how to build automations and manage deployments like this, learn with Automate Naija.

Frequently asked questions

Can I reset an n8n owner password without database access?

If you can edit environment variables, the easiest non DB option is to add SMTP settings so the built in forgot password email can be sent. Without DB or SMTP, you cannot change the owner password from the UI. Database access or temporary SMTP are the practical recovery routes.

What exact Postgres commands will reset the owner password?

Use your Railway DATABASE_URL with psql. For example: psql "$DATABASE_URL" -c "UPDATE public.users SET password = crypt('NewPass123!', gen_salt('bf')) WHERE email = '[email protected]';" Then clear reset token fields if present and redeploy n8n.

Are these SQL changes safe for production?

Yes if you run only the specific UPDATE on the users table and you know the target email. Always backup the database first, and avoid mass updates. If unsure, take a dump with pg_dump or ask a developer to perform the change.

What Railway steps let me add SMTP quickly so reset emails work?

In Railway open your project, go to Settings or Environment, add variables N8N_SMTP_HOST , N8N_SMTP_PORT , N8N_SMTP_USER , N8N_SMTP_PASS and optionally N8N_SMTP_FROM . Save and redeploy the service, then use the n8n forgot password UI.

Build it with us. The community is free and the build track teaches this kind of automation week by week: see pricing or join the community.