phpMyAdmin configuration file now needs a secret passphrase – Solution

If you’ve recently installed or upgraded phpMyAdmin on a Server, you may be displayed with this phpmyadmin blowfish_secret warning message.

"The configuration file now needs a secret passphrase (blowfish_secret)."

This might be alarming, but it’s actually a quick fix — and it’s essential for security.

What Is blowfish_secret?

phpMyAdmin uses cookie-based authentication by default. To secure this process, it encrypts credentials stored in cookies using the Blowfish cipher. For that encryption to work, a secret passphrase (called blowfish_secret) is required.

If this value is missing or too short, phpMyAdmin will display a warning.

Step-by-Step Fix

1. Locate the phpMyAdmin Configuration File

On the server, locate the the main configuration file for phpMyAdmin. For example

/var/www/phpmyadmin/config.inc.php

To edit it, open the file with a text editor:

vim /var/www/phpmyadmin/config.inc.php

If the file doesn’t exist, make sure phpMyAdmin is properly installed.

2. Generate a Secure Blowfish Secret

To create a secure, 32-character random string, use the openssl command:

openssl rand -base64 24

This will return a value like:

rS43xKrJz7RPv7wHf+Y6v1HbUG1rAXqw

Copy that value.

3. Update the Config File

Now, find this line in config.inc.php:

$cfg['blowfish_secret'] = ' ';

And replace it with your generated key from the above command:

$cfg['blowfish_secret'] = 'rS43xKrJz7RPv7wHf+Y6v1HbUG1rAXqw';

Make sure the passphrase is exactly 32 characters, otherwise phpMyAdmin will still show a warning.

Save and exit the config.inc.php file 

4. Restart Apache (if needed)

Although not always required, it’s good practice to restart your web server:

systemctl restart apache2

If you’re using Nginx with PHP-FPM:

systemctl restart php8.4-fpm
systemctl restart nginx

Now, refresh phpMyAdmin in your browser. The warning about the missing blowfish secret should be gone.

Conclusion

Setting the blowfish_secret is a small but critical security step. It ensures the credentials stored in cookies are encrypted, keeping your login sessions secure.

Still facing issues with phpmyadmin blowfish_secret or need expert help in configuring and securing your phpMyAdmin setup? Our team at Skynats specializes in Web Server Optimization and can quickly resolve such errors while keeping your server secure and optimized. Contact us today for reliable support