One of the most common problems that people have when updating from one version of Joomla to another is when they encounter a cryptic “Invalid login” error that appears on the screen.  The problem arises from a failure in the script ../administrator/components/com_joomlaupdate/restore.php, however, knowing which line(s) of code generate the error message is not enough to answer the question:  “What is this ‘invalid login’ we're talking about?“References:

  ▫  "Invalid login" when attempting to update Joomla 3.4.8 to 3.7.5
  ▫  Error 'Invalid login' when trying to update to 3.9.22
  ▫  Trying to update from 3.9.8 to 3.9.16, error - invalid login
  ▫  Error: Invalid login during Joomla upgrade
  ▫  Invalid login when upgrading
  ▫  ERROR: Invalid login - Joomla 3.9.1 Update
  ▫  Got error Invalid Login with 3.9.26 update
  ▫  Invalid login on update
  ▫  Update to 3.9.23 stops with Error: Invalid login
  ▫  Errors in 2.5.26, 3.2.6, and 3.3.5
  ▫  ERROR: Invalid login
  ▫  ERROR: Invalid login - Joomla 3.9.6
  ▫  Error: Invalid login
  ▫  3.9.19 to 3.9.20: AJAX Loading Error: Invalid login
  ▫  I can't get update Joomla from 3.7 to 3.9, I see error invalid login
  ▫  Invalid Login during update
  ▫  Again - Invalid login Error

“Invalid login” is a kind of catch-all error condition that occurs when something goes wrong during the unpacking of the Joomla update package.  You’re probably scratching your head at this lack of specificity but that’s really all we can say about the error message.  We are able, however, to list a few common causes that contribute to problems when running the Joomla! Update component even if we cannot pinpoint the exact cause in every circumstance.

I’m unable to learn about this “secret word” in Joomla:  what is it’s purpose … [and is it] useful for website owner?  Please tell me its complete usage and advantage if you know.forum user, Joomla Forum, 14-Jan-2011

You may be wondering why I dredged up a question asked ten years ago as a preamble to this article.  It’s actually a very good question that has never been really satisfactorily explained in plain English.  For example, if you take some of the “guided tours” of Joomla’s configuration.php fileJoomla 4 Configuration.php file—8-Sep-2021, inmotion.com; A Guided Tour of Joomla's configuration.php File—12-Jun-2019, Joomlashack in one case there is a suggestion that this is displayable in J! 4.x by going to System » Global Configuration » Server » Server (which isn’t true since J! 2.5) and in another case the only information about this setting is that it’s generated when Joomla! is first installed, is not changeable and used “internally” by Joomla! for security purposes; it is true that you cannot change this value using the Global Configuration facility but you can change it by editing the configuration.php file and it’s true that the value is generated when a J! website is created but the internal purposes of \(secret are not explained.  Can you change \)secret or can’t you (and what happens if you do)?  To further confuse the matter, some people have recommended that you should change this value https://www.itoctopus.com/25-joomla-important-tips.

In this article we will discuss one line of code in the file configuration.php (at about line 20) located in the root folder of a J! website.  It looks like something like this:

	public $secret = 'RndmL3ttrsNumbrs';