What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
MySQL error 1045 (28000), “Access denied for user ‘name’@’host’ (using password: YES),” means the server reached authentication but rejected the account attempt. The usual causes are a wrong password, a User/Host account mismatch, a locked account, or an authentication-plugin incompatibility. “Using password: YES” only confirms that the client sent a password; it does not mean the password was correct.
Fix it by identifying the exact user and host in the error, testing the intended socket or TCP path, inspecting the matching account row with an administrator connection, and then correcting the credential or account definition without granting broader access than necessary.
As an Amazon Associate I earn from qualifying purchases.
What error 1045 is actually telling you
MySQL authenticates an incoming connection in stages. It uses the user name supplied by the client and the client host to select an account row, then validates the credentials with that row’s authentication plugin and checks that the account is unlocked. If any of those checks fails, the connection is rejected with error 1045.
The text in the message is diagnostic:
'name'is the user name MySQL received.'host'is the source host MySQL associated with the connection. It may belocalhost,127.0.0.1, a remote host name, an address, or an unexpected/empty value.using password: YESmeans a password was supplied. It does not confirm a match.using password: NOmeans the client did not send a password, which can happen when a command omitted-p, a connection string supplied an empty value, or an application failed to load its secret.
A successful login followed by “permission denied” is a different problem. Error 1045 occurs during connection verification, before MySQL evaluates the account’s normal database privileges.
Start with the complete error and the exact connection path
- Copy the entire message. Record the user, host, error number, and whether the suffix says
YESorNO. Do not troubleshoot from a shortened message that omits the host. - Confirm which client command or application produced it. Note the server name, port, socket setting, environment variables, and whether a password prompt appeared. An application can use different defaults from the command you test in a terminal.
- Repeat the test while making the transport explicit.
localhostcommonly uses a Unix socket, whereas127.0.0.1forces TCP. Those paths can select different account rows.
| Test | What it forces | Why it matters |
|---|---|---|
mysql -u name -p |
Client defaults | Useful as a baseline, but the client may choose a socket for localhost. |
mysql --protocol=socket -u name -p |
Unix socket | Checks the local socket path and commonly matches a name@localhost row. |
mysql --protocol=tcp -h 127.0.0.1 -u name -p |
TCP to the local machine | Checks a name@127.0.0.1 row instead of the socket account. |
mysql --protocol=tcp -h remote-host -u name -p |
TCP from the client to a remote server | Tests the host identity and account row used for a remote connection. |
Enter the password at the prompt rather than placing it directly in the command line, where it can be exposed in shell history or process listings. If one path works and another fails, the difference is evidence of a Host-row or transport problem rather than proof that the password is universally wrong.
Inspect the account row with an administrative connection
You need an administrator account that can read the MySQL system tables. Connect through a path that still works, then inspect the row for the affected user. Replace name with the exact user shown in the error:
SELECT User, Host, plugin, account_locked, authentication_string
FROM mysql.user
WHERE User = 'name';Review these fields together:
UserandHost: MySQL accounts are identified by this pair.name@localhost,name@127.0.0.1, andname@remote-hostare separate accounts even when the user name is identical.plugin: This determines how MySQL validates the supplied credentials. A client that cannot implement the requested plugin can fail authentication even when the entered password is correct.- Account lock state: A locked account is rejected before ordinary database privileges are considered.
- Authentication data: Confirm that the row has credential data managed by MySQL. Never paste password hashes or secrets into a ticket, forum post, or log.
If no row matches the user and the host used by the connection, the server has no suitable account definition for that attempt. If several rows exist, the most-specific host match can take precedence over a wildcard row. This is why adding a new wildcard account does not necessarily fix a failure caused by a more-specific local row.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Correct a wrong password or an account definition
Reset the password on the exact matching account
After confirming the intended User/Host pair, reset its password through the administrator connection. Use the authentication syntax supported by your server version and policy:
ALTER USER 'name'@'host' IDENTIFIED BY 'a-new-strong-password';Replace host with the value that should match the client, such as localhost, 127.0.0.1, or a specific remote host. Then retest using the same socket or TCP path that produced the error. If the application stores a separate secret, update that configuration as well; changing MySQL alone does not change an application’s saved password.
Unlock an account that is intentionally permitted to connect
If the row shows that the account is locked, unlock it only after confirming that the account is still needed and that its password and host restriction are appropriate:
ALTER USER 'name'@'host' ACCOUNT UNLOCK;Do not unlock an account simply to make an error disappear. Verify who uses it, rotate the password if it may have been exposed, and keep the host as specific as the deployment allows.
Recommended Free Tools
Create the missing account with a narrow host and grant
If the intended account does not exist, create it for the real client host rather than immediately using a wildcard:
Rank #3
CREATE USER 'name'@'client-host' IDENTIFIED BY 'a-strong-password';
GRANT SELECT, INSERT, UPDATE ON appdb.* TO 'name'@'client-host';Choose privileges that match the application’s actual work. A read-only service should not receive write privileges, and an application that uses one schema does not need access to every database. If the account already exists, use ALTER USER for credentials and a deliberate GRANT or REVOKE change for privileges rather than creating a second, ambiguous row.
Separate authentication from database privileges
Once the account can connect, check what it is authorized to do:
SHOW GRANTS FOR 'name'@'host';If this command shows insufficient privileges, fix the grants; do not keep changing the password. Conversely, adding grants cannot repair error 1045 because the server has not completed authentication yet. Keeping these stages separate prevents an overbroad privilege change from masking a credential or host mismatch.
Fix local failures caused by localhost versus TCP
Local applications often fail because the administrator created one account row while the client uses another connection method. For example, a socket connection may arrive as name@localhost, while a TCP connection to 127.0.0.1 is evaluated against name@127.0.0.1. Test both explicitly, inspect both rows, and decide which path the application should use.
Rank #4
- What You Get: 148-in-1 Network Tool Kit for Cat5/Cat5e/Cat6. Includes 1PCS ethernet crimper,1PCS rj45 cable tester,1PCS mini wire stripper,1PCS flatscrewdriver, 1PCS cross screwdriver, 1PCS wire cutter plier, 1PCS punch-down tool,100PCS cable zip ties, 20 cat5 connectors,20 relief boots and 1PCS rj45 tool bag—everything needed for convenient work
- Attention Please: The rj45 connectors within rj45 crimp tool kit are regular connectors, not pass through connectors
- Why Choose Us: Fast, reliable ethernet crimp tool with steel body construction for durability with ergonomic comfort grips. Ratchet safety-release and a blade-guard on cutting and stripping knives reduce risk of injury
- Improve Work Efficiency: Professional Network Ethernet Crimper, Save Time and Effort. 3-in-1 ethernet crimping/cutting/stripping tool, which is good for rj45, rj11, rj12 connectors, and suitable for 6 and 8 position modular plugs/connectors
- Professional Network Cable Tester: Tests double-twisted cables 1-8, detecting wrong connections, short circuits, and open circuits. Compatible with RJ45, RJ11, Cat5, Cat5e and Cat6 ethernet Cable. Powered by a 9V battery (not included)
Do not assume that name@% is a universal fallback. A more-specific localhost or address row can shadow it, and a wildcard permits connections from more places than necessary. The safer repair is usually to create or correct the row for the actual source host and then configure the client to use that path consistently.
Fix remote-login failures without widening exposure
Identify the host MySQL is matching
For a remote attempt, read the host printed in error 1045 and compare it with the account rows. A name-based host and an address-based host may not resolve to the same value. The server must find a row whose User and Host match the connection according to MySQL’s account-selection rules.
Prefer a specific source over %
Create the account for the application server’s actual host or controlled network range when possible. A wildcard row can be useful in narrowly controlled cases, but it broadens the set of clients that can attempt authentication and may still lose to a more-specific row. After changing the row, retest from the real remote machine, not only from the database server itself.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchCheck the server’s network and name-resolution assumptions
If the error contains an unexpected or empty host, investigate hostname resolution and the server’s view of the client address. MySQL documents the host cache as part of this troubleshooting path. Where a stale or incorrect cache is the identified cause, an administrator can flush it:
Best Value
FLUSH HOSTS;Use that command deliberately and then repeat the connection test. A cache flush does not create an account, repair a password, or replace checking DNS and the client’s actual source address.
Resolve authentication-plugin and client incompatibility
The account’s plugin controls credential verification. A password that looks correct can still fail when an old connector, driver, or application cannot support the plugin selected for the account.
- Inspect the account’s
pluginvalue and record the connector or driver version used by the failing application. - Check whether that client supports the server’s requested authentication method. Test with a current connector when an upgrade is available and permitted by your application.
- If the client cannot be upgraded, have an administrator choose a compatible, security-appropriate account method that conforms to the server’s policy. Do not weaken authentication blindly or change a production account before testing.
- After any plugin or credential change, retest the exact application connection and confirm that other clients using the account still work.
Plugin compatibility is distinct from a mistyped password: changing the password repeatedly will not make an unsupported client implement a missing authentication method.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsQuick Recap
Use this symptom-to-cause checklist
| Symptom | Most useful check | Targeted correction |
|---|---|---|
using password: NO |
Command flags, connection string, environment variables, and application secret loading | Supply the intended secret without exposing it on the command line. |
localhost fails but 127.0.0.1 works |
Socket versus TCP tests and separate Host rows |
Correct the matching local account or standardize the client’s transport. |
| Local login works but remote login fails | Remote host shown in the error, specific account rows, and host resolution | Create or alter the account for the real remote source; avoid an unnecessary wildcard. |
| Password appears correct but every attempt fails | Account row, lock state, and authentication plugin | Reset the exact account, unlock it when appropriate, or use a compatible connector/method. |
| Login succeeds but a query is denied | SHOW GRANTS for the authenticated account |
Adjust least-privilege grants; do not keep changing authentication settings. |
| Host in the error is blank or unexpected | Name resolution and host-cache behavior | Correct DNS or host identity and flush the host cache only when that is the diagnosed issue. |
Final verification sequence
- Reconnect with the same user, host, protocol, and client that originally failed.
- Confirm that the error no longer appears and that the application reaches the server.
- Run a minimal operation appropriate to the account, then verify its expected database privileges with
SHOW GRANTS. - Review the account’s host restriction, lock state, plugin, and password-handling configuration.
- Remove temporary test accounts or broad grants created during diagnosis.
As an optional Windows shortcut for broader system-side problems accompanying a failed database client, Outbyte PC Repair can address more than 100 common Windows issues where possible, adjust settings that affect CPU, RAM and disk load, clean temporary and cache files, check Windows settings and missing updates, and provide an app-crash log. It runs on Windows 11, 10, 8 and 7 and offers a free trial by category for at least two days before a paid subscription. Results vary; it complements antivirus software and does not replace it, and no tool repairs every crash.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
