You click into phpMyAdmin to tweak one table, step away for a coffee, and come back to "Token mismatch" or "Your session has expired. Please log in again." Or worse, you can't get in at all because the login page just bounces you back to itself. It's annoying, but it's almost always a session or cookie problem, not a database problem. Your data is fine.
This guide covers both setups we see on SkyServer: phpMyAdmin launched from cpanel" class="auto-link">cPanel, and a self-installed phpMyAdmin on a VPS.
Symptoms you'll see
- "Token mismatch" or "Invalid token" after clicking any link or running a query.
- "Your session has expired" after only a few minutes of inactivity.
- "Cannot start session without errors" on a VPS install.
- The login form reloads with no error at all (a silent login loop).
- phpMyAdmin works in one browser but not another.
How phpMyAdmin sessions actually work
phpMyAdmin keeps you logged in with a session cookie, and every request carries a token that must match what the server stored for that session. If the cookie is lost, blocked, or the server can't read or write the session file, the token no longer matches. That's the whole "Token mismatch" story.
On cPanel, there's a second layer. You reach phpMyAdmin through a one-time sign-in from cPanel, and cPanel itself has a session (the cpsessXXXXXXXXXX part of the URL). If that outer session dies, phpMyAdmin dies with it.
Fix 1: cPanel users — start fresh from cPanel
Don't bookmark the phpMyAdmin URL. It contains a session token that expires. Instead:
- Log out of cPanel completely, then log back in.
- Open Databases → phpMyAdmin from the cPanel home screen.
- Let it open in the new tab cPanel creates for it. Don't copy that URL to another browser or device.
If it works now, the old tab was simply holding a dead token. Close any stale phpMyAdmin tabs, because an old tab can overwrite the cookie and break the new one.
Fix 2: Clear the cookies for just your domain
A corrupted or oversized cookie is the most common culprit we see. In your browser, clear cookies for your server hostname (for example server.example.com or the cPanel hostname on port 2083) only, not everything. Then reload and log in again.
Also check:
- Your browser isn't blocking third-party or "all" cookies for the cPanel hostname.
- A privacy extension or ad blocker isn't stripping cookies. Test once in a private window with extensions disabled.
- Your system clock is correct. A badly wrong clock makes cookies look expired the instant they're set.
Fix 3: Session expires too fast
If you stay logged in but get kicked out after a few minutes, it's a timeout. Here's where each timeout lives:
| Where | Setting | What it controls |
|---|---|---|
| cPanel | Session timeout (server-wide, set in WHM) | How long cPanel stays logged in when idle |
| phpMyAdmin | $cfg['LoginCookieValidity'] | How long the phpMyAdmin login cookie is valid (seconds) |
| PHP | session.gc_maxlifetime | How long PHP keeps session data before deleting it |
The last two must agree. If LoginCookieValidity is 8 hours but session.gc_maxlifetime is 24 minutes, PHP deletes your session at 24 minutes and you get the expired message. On a VPS, set both in the config:
# /etc/phpmyadmin/config.inc.php (path varies by distro)
$cfg['LoginCookieValidity'] = 3600;
# php.ini
session.gc_maxlifetime = 3600Then restart PHP-FPM or Apache. On a shared cPanel account you can't change the cPanel timeout yourself; open a ticket and we'll check it.
Fix 4: VPS — "Cannot start session without errors"
This one means PHP can't write its session files. Check the session path and permissions:
php -i | grep session.save_path
ls -ld /var/lib/php/sessions
df -h /var/lib/php/sessionsLook for three things: the directory exists, it's writable by the web server user (www-data on Ubuntu/Debian, apache or nginx on AlmaLinux/Rocky), and the disk or inodes aren't full. A full disk is a surprisingly common cause. If that's your situation, our disk-full guide walks through clearing space.
chown root:www-data /var/lib/php/sessions
chmod 1733 /var/lib/php/sessionsMatch the group to your own web server user. If SELinux is enforcing on AlmaLinux or Rocky, a wrong file context can also block writes, so check ausearch -m avc -ts recent.
Fix 5: VPS — blowfish secret and the silent login loop
If the login form just reloads, check blowfish_secret in the phpMyAdmin config. It must be set, and it must be at least 32 characters. Too short and newer versions refuse to keep the session.
$cfg['blowfish_secret'] = 'paste-a-random-32-plus-character-string-here';Generate one with openssl rand -base64 32. Changing it logs everyone out once, which is fine.
Fix 6: Behind a reverse proxy or Cloudflare
If you've put phpMyAdmin behind Nginx or a proxy that terminates HTTPS, phpMyAdmin may think it's on plain HTTP and set a cookie the browser then refuses to send back. Make sure the proxy passes the right headers:
proxy_set_header Host $host;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;If it still loops, set $cfg['PmaAbsoluteUri'] to the full https URL. Also make sure your proxy isn't caching the login page. Never cache phpMyAdmin.
Quick diagnosis table
| What you see | Most likely cause | Go to |
|---|---|---|
| Token mismatch after an idle period | Expired or stale session | Fix 1, 3 |
| Works in private window only | Bad cookie or extension | Fix 2 |
| Cannot start session | Session directory not writable or disk full | Fix 4 |
| Login reloads silently | Short blowfish secret or HTTPS mismatch | Fix 5, 6 |
Prevention
- Always open phpMyAdmin from the cPanel menu instead of an old bookmark.
- Keep one phpMyAdmin tab open at a time.
- For long imports or exports, use the command line (
mysqldump,mysql < file.sql) so a session timeout can't interrupt them. - On a VPS, monitor disk and inode usage so session writes never fail.
- Restrict phpMyAdmin to your own IP or put it behind HTTP basic auth. It's a popular attack target.
Still stuck? Send us the exact message you see, your browser, and whether it's cPanel or a VPS install. With that we can usually pinpoint it in one reply.
Frequently Asked Questions
Does "Token mismatch" mean my database is corrupted?
No. It's purely a browser-to-server session issue. Your tables and data aren't touched.
Why does phpMyAdmin work in Chrome but not Firefox?
Usually a stale cookie or an extension in the browser that fails. Clear cookies for your server hostname in that browser and test again in a private window.
Can I increase the phpMyAdmin timeout on shared hosting?
The cPanel session timeout is set server-wide, so you can't change it from your account. Raise a ticket and we'll tell you what's possible, or use the command line for long tasks.
Is it safe to bookmark my phpMyAdmin link?
On cPanel, bookmark your cPanel login instead. The phpMyAdmin link carries a temporary session token that stops working.
My VPS phpMyAdmin says the blowfish secret is too short. What now?
Set $cfg['blowfish_secret'] to a random string of at least 32 characters and reload the page.
