Updating README.md

README.md

@@ -38,13 +38,27 @@ PackIt is a smart packing list generator for outdoor activities. Select the acti
 3. Serve the project with any PHP-capable web server (Apache, Nginx, PHP built-in server).
 4. Open the site in a browser and start selecting activities.
 
-### Default admin credentials
+### Admin password
 
-| Username | Password      |
-|----------|---------------|
+Admin credentials live in the `admin_users` table, not in `config.php`. The `password_hash` column stores a bcrypt hash produced by PHP's `password_hash()`; `admin/login.php` verifies the submitted password against it with `password_verify()`.
+
+`schema.sql` seeds a default account:
+
+| Username | Password       |
+|----------|----------------|
 | `admin`  | `packit-admin` |
 
-**Change the password after first login.**
+**Change it after first login.** There is no UI for this yet, so update the row directly — generate a new hash and replace it in the database:
+
+```
+php -r "echo password_hash('your-new-password', PASSWORD_BCRYPT), PHP_EOL;"
+```
+
+```sql
+UPDATE admin_users
+SET password_hash = '<paste-hash-here>'
+WHERE username = 'admin';
+```
 
 ## Project structure