ModKor Password Reset for Magento 2

1. What it does

Magento's built-in Reset Password only emails the customer a link. ModKor Password Reset lets an authorised admin set the password directly — it takes effect immediately. Perfect for a customer on the phone, a staff or wholesale login you manage, or an account migration.

Highlights

• Set it, don't send it — search a customer, type or generate a password, apply it instantly.
• Button on the customer page — a Set / Reset Password button deep-links here with the customer pre-selected.
• Policy-enforced — validated against your store's own customer password policy.
• Secure — Magento's salted hashing, active sessions invalidated, plaintext never stored/logged/emailed.
• Optional notice & unlock — email the standard "password changed" notice and clear a failed-login lock.
• Audit log — every reset recorded with the acting admin and the customer.

2. Requirements

• Magento Open Source / Adobe Commerce 2.4.x
• PHP 8.1 – 8.4 · any storefront theme (admin-only module)
• ModKor_Core (ships with the suite)

3. Installation

composer require modkor/module-password-reset
bin/magento module:enable ModKor_Core ModKor_PasswordReset
bin/magento setup:upgrade
bin/magento setup:di:compile            # production
bin/magento setup:static-content:deploy # production
bin/magento cache:flush

It's free — composer require pulls it from the ModKor repository at no cost. Grant the permission under System → Permissions → User Roles → ModKor → Customer Password → Set Customer Password.

4. Set a password in 20 seconds

1. Open System → ModKor → Customer Password → Set Password.
2. Search by email, name or customer number and pick the customer.
3. Type a password, or click Generate for a strong one (use Show to read it back).
4. Re-enter it in Confirm password — the three rule chips must all turn green.
5. Choose whether to email the customer and unlock if locked, then click Set Password.

5. From the customer page

Open any saved customer (Customers → All Customers → Edit) and click Set / Reset Password in the top button bar — right next to Magento's email-only Reset Password. You land on the tool with that customer already selected, and the Back button returns you straight to that customer when you're done.

6. The new password

Type your own or click Generate for a strong, policy-compliant password (real CSPRNG entropy, one of every required character class). The three chips confirm length, character classes and that both entries match — Set Password stays disabled until all three are green. The password itself is never emailed; read it back to the customer over a trusted channel.

7. Notify & unlock

Email the customer sends Magento's standard "your password was changed" notice (never the password). Unlock if locked clears any failed-login lock at the same time so the customer can sign in right away. Both default on and are set per reset.

8. Configuration & permissions

Defaults live in the module config (Enabled, email-by-default, unlock-by-default, generated length). The password policy itself is Magento's own, at Stores → Configuration → Customers → Customer Configuration → Password Options — this module simply honours it. Grant ModKor → Customer Password → Set Customer Password to the roles that should be allowed; without it, the screen and the customer-page button are hidden.

9. Security notes

• The password is stored with Magento's standard salted hash — identical to a normal change.
• The plaintext is never written to the database, the log, or an email.
• Active sessions are invalidated on reset, so it can be used to lock out an intruder.
• Every reset is recorded in var/log/modkor.log with the acting admin and the customer.
• Setting a password is immediate and cannot be undone — double-check the selected customer.

10. Troubleshooting