hash_password -c homeserver.yaml

Prompts for a password twice and prints the bcrypt hash to stdout, matching the bcrypt_rounds and pepper settings in your config. That hash can replace the password_hash column in the Synapse database to reset a locked-out user's password directly. The Admin API reset_password endpoint achieves the same result without touching the database. Never store plaintext passwords.