What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
MySQL error 1045 is an authentication failure, not a generic server outage. Start with mysql -u root -p and enter the password interactively. If the message says using password: NO, no password was sent; using password: YES means a password was sent but rejected. If the result changes between localhost and 127.0.0.1, you are testing different transports and possibly different root account rows. The steps below identify which condition applies before you change credentials or grants.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
What error 1045 actually means
A typical message is ERROR 1045 (28000): Access denied for user 'root'@'localhost'. The server received a connection attempt, identified the requested account as root from localhost, and rejected authentication. SQLSTATE 28000 denotes an authorization or authentication failure. It does not by itself indicate that the MySQL service is stopped; a stopped service normally produces a connection error before authentication is attempted.
As an Amazon Associate I earn from qualifying purchases.
MySQL authenticates the pair of values in the account name: User and Host. A row for root@localhost is a different account from root@127.0.0.1 or root@db.example. The password and authentication plugin belong to the matched row, so using the right password against the wrong host row still produces 1045.
Read the password suffix literally
| Message ending | What the client sent | First check |
|---|---|---|
using password: NO |
No password was supplied to the client. | Retry with -p and enter the password when prompted. Also check whether the account is intentionally passwordless after an insecure initialization. |
using password: YES |
A password value was sent, but the server did not accept it. | Check the password, the selected host/transport, and whether an option file supplied an old password. |
The suffix describes the request that reached the server, not whether you personally typed a password during that command. A client option file can inject one without an interactive prompt.
#1 Best Overall
Choose the right branch before changing anything
| Your situation | Most likely explanation | Safe first action |
|---|---|---|
You ran mysql -u root and see NO. |
The client sent no credential. | Run mysql -u root -p. |
You see YES although you did not enter a password. |
An option file or environment-level client setting supplied one. | Run mysql --no-defaults -u root -p. |
localhost fails but 127.0.0.1 works. |
The two commands selected different transports and possibly different account rows or plugins. | Decide whether the account is intended for a Unix socket or TCP, then inspect the matching row. |
127.0.0.1 fails but localhost works. |
The TCP account row, TCP authentication plugin, or TCP listener does not match. | Use the working socket connection to inspect User, Host, and plugin. |
| Both transports fail and the password is unknown. | The credential must be reset using the procedure for the installed server version and operating system. | Use MySQL’s current password-reset procedure, then assign the password with ALTER USER. |
The data directory was initialized with --initialize-insecure. |
The root account may deliberately have no password. | Connect only through a protected local path and set a password immediately. |
| The failure started after an upgrade. | The configured authentication plugin may no longer be supported or enabled. | Check the server version and account plugin before changing the account. |
Step 1: retry with an interactive password
Use this exact form:
mysql -u root -pWhen the client displays Enter password:, type the password and press Enter. Nothing is echoed. Keeping the password out of the command line prevents it from appearing in shell history and process listings in the way a command such as mysql -u root -pSecretPassword can.
Do not add a space and a password after -p. With no value attached, -p requests an interactive prompt. If the login succeeds, the original command simply omitted the credential. If it still returns 1045 with using password: YES, continue rather than repeatedly guessing: the next checks distinguish a stale client setting from a wrong account or password.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Step 2: bypass stale option-file credentials
MySQL clients read option files that can provide a user name, host, port, socket, or password. An old password in one of those files can make a command fail even when you believe you supplied no password. Suppress those defaults for one test:
mysql --no-defaults -u root -pThis invocation still lets you enter a password interactively, but it does not load the normal option-file settings for that run. Compare its result with the ordinary command:
- Run
mysql -u root -pand note the complete error, includingNOorYES. - Run
mysql --no-defaults -u root -pand enter the same intended password. - If the second command works, inspect the client option files used by your operating system and remove or correct the obsolete credential, host, socket, or port. Keep credentials out of shared files unless their permissions and purpose are understood.
- If both commands fail identically, the problem is more likely the password, account host row, transport, or server-side plugin.
--no-defaults is a diagnostic bypass, not a permanent configuration fix. It can also remove a required socket or port setting, so a changed connection target is possible; compare the host and transport explicitly in the next step.
Step 3: test the socket and TCP paths separately
On a local installation, localhost normally makes MySQL programs use a Unix socket. The MySQL Reference Manual states that a TCP/IP connection requires connection parameters that force TCP. Use these two explicit tests:
mysql -u root -pmysql -h 127.0.0.1 -u root -pThe first command normally uses the local socket; the second requests TCP/IP to the loopback address. You can also make the host choice explicit with -h localhost, but that still normally resolves to socket behavior on common Unix installations. A successful socket login does not prove that a TCP login should work, and vice versa.
When localhost works but 127.0.0.1 fails
The root account may exist only as root@localhost, or its socket authentication plugin may accept local socket credentials while rejecting a TCP client. Use the working socket session to inspect the account rows and plugin. Do not “fix” this by adding a root account for every host unless remote access is genuinely required.
When 127.0.0.1 works but localhost fails
The TCP request is matching a different row, while the socket row is absent, has another password, or uses an authentication method your client cannot complete. Verify the socket path and the root@localhost row rather than assuming the password is wrong.
When both fail
Run the no-defaults test first. If the password is known and both transports still return 1045, inspect the account rows from another administrative account or proceed to the version-appropriate reset procedure.
Free tools Windows power users keep installed
One-click scans. No signup required.
“For connections to
localhost, MySQL programs attempt to connect to the local server by using a Unix socket file, unless there are connection parameters specified to ensure that the client makes a TCP/IP connection.” — MySQL Reference Manual
Step 4: inspect the matching account row
You need an administrative session to query the grant tables. If another administrator can log in, run:
Rank #3
SELECT User, Host, plugin FROM mysql.user WHERE User = 'root';The result shows which host values exist for root and which authentication plugin each row uses. Compare those values with the command you are running:
- A command using the socket normally needs a row whose
Hostmatcheslocalhost. - A command using
-h 127.0.0.1needs a row that MySQL’s host-matching rules select for that address. - A hostname, container name, or remote address can select yet another row.
- The
plugincolumn explains why a password that works for one row is rejected by another.
MySQL grant-table matching uses both User and Host; it is not enough to see a root user somewhere in the table. If you administer a system with multiple root rows, record which row is used by each connection method before changing a password.
Recommended Free Tools
Why granting root to % is a poor shortcut
A host value of % is a wildcard that permits connections from any host. The MySQL security documentation warns that such a grant leaves the account insecure. It can expose a highly privileged account to every reachable network, and it can mask the real host-matching problem. Prefer the narrow host row required by the deployment, and use a separate least-privilege administrative account for routine work.
Step 5: reset a forgotten root password safely
If the password is genuinely lost, repeated login attempts cannot recover it. The exact recovery commands depend on the MySQL server version, operating system, service manager, and whether the installation uses a socket or TCP. Use the current MySQL password-reset procedure for that installed version instead of copying an old command from an unrelated release.
The safe recovery sequence has these stages:
- Identify the installation. Confirm which server instance and data directory you are repairing, and note the installed MySQL version and operating system. A client binary’s version is not always the server’s version.
- Restrict access. Stop the normal server and follow the official procedure to start a temporary recovery mode, such as an initialization file or the version-appropriate grant-bypass method. Perform this on a controlled local machine; do not expose a recovery instance to a network.
- Connect through the intended local path. The temporary mode may require a socket connection and may not accept the same host or port as the normal service.
- Change the exact account row. After administrative access is available, assign a new credential with the account’s real host value, for example:
ALTER USER 'root'@'localhost' IDENTIFIED BY 'a-long-unique-password';Replace localhost only when inspection shows that the required root row has another host. Altering root@localhost does not change root@127.0.0.1.
- End recovery mode. Shut down the temporary instance, remove any temporary initialization file containing the password, and restart MySQL normally using the service’s documented method.
- Verify both security and connectivity. Test the intended socket or TCP command with
-p, then confirm that the server is no longer running with grant checks bypassed.
Do not leave a recovery option, plaintext password file, or grant-bypass process in place. If the official instructions for your release use a different syntax, follow those instructions; password-reset procedures are version-specific for a reason.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Rank #4
Step 6: handle an insecure initialization
MySQL documents that initializing with mysqld --initialize-insecure can permit a passwordless root login and describes that state as a security risk. In that situation, a command with no -p may be the expected way to enter locally:
mysql -u rootOnce connected, set a password immediately with ALTER USER for the actual root host row. Then close the session and verify that mysql -u root is rejected while mysql -u root -p succeeds. Do not interpret a passwordless local login as evidence that the server is correctly secured; it is an initialization condition that must be corrected.
Step 7: check authentication-plugin and version compatibility
The account’s authentication plugin must be supported by both the server and the client. Query the plugin column as shown above, then check the server release before changing it.
MySQL 8.4
MySQL 8.4 disables mysql_native_password by default. An account configured to use that legacy plugin can therefore fail after an upgrade even when its old password is correct. Prefer a current client and the authentication plugin supported by the server rather than enabling a legacy plugin globally.
MySQL 9.0
MySQL 9.0 removes mysql_native_password. A migration that worked on an older server can consequently produce an authentication failure after the upgrade. Update clients and account definitions to a supported plugin before attempting another password reset.
Changing an authentication plugin is not interchangeable with changing a password. It can affect client-library compatibility, replication tooling, and applications. Make the change for the specific account and test every client that uses it; do not make a legacy plugin the default merely to silence error 1045.
Common failed fixes and what they teach you
Adding -p but still getting YES
This confirms that a credential reached the server, not that it was the credential you intended. Run the --no-defaults command, then inspect host selection and the account plugin.
Changing only the password for one host row
If the application connects over TCP while you changed root@localhost, nothing about the TCP row changes. Match the ALTER USER target to the connection’s selected Host.
Replacing the host with %
This may make a test connection appear to work, but it broadens access to every host and creates a serious exposure for a privileged account. Solve the matching problem with the narrowest required host instead.
Copying a reset command from another MySQL release
Recovery flags, service commands, and plugin behavior differ by version and platform. An obsolete command can fail, leave the server in an unsafe mode, or change the wrong instance. Identify the server version and use the corresponding official procedure.
Assuming the error is caused by a stopped service
Error 1045 means the server got far enough to reject authentication. If the service were unreachable, you would normally see a connection or socket error instead. Check service status only after distinguishing connectivity from authentication.
A repeatable diagnostic checklist
- Copy the entire error, including the account host and the
using passwordsuffix. - Run
mysql -u root -pand enter the password interactively. - Run
mysql --no-defaults -u root -pto eliminate stale option-file values. - Compare socket access with
mysql -h 127.0.0.1 -u root -p. - From a working administrative session, query
User,Host, andpluginfor every root row. - Do not add
Host='%'as a shortcut. - If the password is lost, use the reset procedure for the installed version and then run
ALTER USERon the correct host row. - If the data directory was initialized insecurely, set a password before allowing normal use.
- After upgrades, verify plugin support:
mysql_native_passwordis disabled by default in MySQL 8.4 and removed in MySQL 9.0. - Retest the exact transport used by the application, not merely a different local command that happens to work.
Bottom line
Error 1045 becomes manageable when you treat it as a precise account-and-transport mismatch. Start with an interactive password, remove hidden option-file credentials, distinguish the Unix socket from TCP, inspect the exact User/Host row, and only then reset credentials or address plugin compatibility. Keep host grants narrow and finish by returning the server to normal, authenticated operation.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteQuick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
