Free tools Windows power users keep installed
One-click scans. No signup required.
If you can stop MySQL and control how it starts, use a temporary --init-file: it changes the password during startup without disabling authentication for the running server. Use --skip-grant-tables only as an emergency recovery path, because it starts MySQL without its privilege system and lets anyone with local access connect without a password.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
The procedures below cover Windows and Unix-like systems, explain why ALTER USER can fail in recovery mode, and show how to return the server to its normal, authenticated configuration.
As an Amazon Associate I earn from qualifying purchases.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Choose the reset method before stopping MySQL
There are two documented approaches. The init-file method is the controlled choice: you place one ALTER USER statement in a protected text file, start MySQL with that file, remove it after the password is applied, and restart normally. The generic method starts MySQL with --skip-grant-tables; this is broader but deliberately unsafe while it is running.
| Characteristic | Temporary init file | --skip-grant-tables |
|---|---|---|
| Platform coverage | Documented separately for Windows and Unix-like systems | Generic client-based recovery procedure |
| Authentication | Remains part of the normal server design; the password change is executed during startup | Disabled because grant tables are not read |
| Remote networking | Not changed by the method itself | MySQL enables skip_networking, so remote connections are disabled while this mode is active |
| Exposure | Limited to the startup interval and to users who can read the init file | Anyone who can connect locally can connect without a password and has unrestricted privileges |
| Operational complexity | Requires a readable, protected file and a controlled restart | Requires a temporary server, a local client connection, FLUSH PRIVILEGES, and a second restart |
| Cleanup | Delete the file containing the replacement password, then restart normally | Stop the temporary instance and restart without --skip-grant-tables or skip_networking |
Oracle’s manual summarizes the danger of the emergency option this way: “This enables anyone to connect without a password and with all privileges.” Treat that as a recovery window, not as a configuration to leave enabled.
#1 Best Overall
Prepare the reset safely
- Confirm which MySQL instance you are changing. On a host with more than one instance, identify the normal data directory, configuration file, service definition, and port before stopping anything.
- Plan a new password. Use a unique, long value and keep it available while you complete the restart and verification. Do not put it in a shell history, ticket, or chat message unnecessarily.
- Identify the complete account name. MySQL accounts include a user and a host part. The examples use
'root'@'localhost'; if the actual root account has another host component, substitute that value in every command. - Ensure you can stop and start the service. The exact command depends on your service manager or hosting environment. Preserve the sequence in this guide, but use the commands appropriate for your installation.
- Protect temporary files. The init file contains the replacement password in plain text. Store it where the MySQL service account can read it but ordinary users cannot.
Preferred method: reset with a temporary init file
The init file is read during server startup. Its one-line account-management statement runs before normal client authentication is useful, so you do not need the old password.
Windows procedure
- Sign in as a Windows Administrator. You need authority to stop the MySQL service, start the server with a different option, and write a file readable by the service account.
- Stop the MySQL service. Use the Services console or the service-management command used by your installation. Confirm that the intended MySQL instance has stopped before continuing.
- Create a one-line init file. For example, create a file such as
C:mysql-init.txtcontaining exactly:ALTER USER 'root'@'localhost' IDENTIFIED BY 'MyNewPass';
Replace both the host part and the password as required. Do not add unrelated statements. - Restrict the file. Save it in a location the account that runs the MySQL service can read, while preventing other Windows users from reading it. The file is a secret, not a permanent configuration file.
- Start MySQL with the init file. Start the server using the normal executable and its normal configuration options, adding an option such as
--init-file=C:mysql-init.txt. If your installation normally uses a specific defaults file or data directory, retain those options. - Wait for successful startup. Check the MySQL error log or service status for a normal startup. A startup failure usually means the path, permissions, configuration options, or account host value needs correction.
- Delete the init file immediately after the statement has run. Removing it prevents the replacement password from remaining on disk.
- Stop the temporary server and start the service normally. Remove the temporary
--init-fileoption. The ordinary service definition must be used for the final start.
Unix and Unix-like procedure
- Log in as the Unix account that normally runs MySQL. This is often an account named
mysql. Using the normal account avoids ownership changes in the data directory. - Stop
mysqld. Use your distribution’s service manager or the deployment’s normal stop command, and verify that the old process is no longer serving connections. - Create a protected init file. Put one statement in a file such as
/var/lib/mysql/mysql-init:ALTER USER 'root'@'localhost' IDENTIFIED BY 'MyNewPass';
Set ownership and permissions so only the MySQL service account (and an administrator who must manage it) can read the file. A mode such as0600is appropriate when the file is owned by the service account. - Start the server with the file. The documented pattern is:
mysqld --init-file=/path/to/mysql-init &
Add the normal options your installation requires, such as--defaults-file=/path/to/my.cnf. Use the same data directory, socket, and other startup settings as the regular instance. - Do not start the data directory as root by accident. Starting
mysqldas root without--user=mysqlcan create root-owned files and lead to permission failures on later starts. Run the daemon as its normal account or explicitly provide the appropriate user option. - Confirm startup and the password change. Review the error log for successful startup and then test a local login with the new password.
- Remove the init file. Delete it as soon as the startup statement has executed; it contains the replacement password in clear text.
- Stop the temporary process and restart normally. Start MySQL through the normal service configuration, without the temporary
--init-fileoption.
Verify the normal service
After the final restart, connect through the normal local client path and prompt for the new password, for example:
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsmysql -u root -pA successful prompt and login confirms that the account can authenticate in the ordinary configuration. If the test fails, stop before making more changes: check that you changed the correct host component, that the final start did not retain a temporary option, and that you are connecting to the intended instance.
Rank #2
Emergency method: use --skip-grant-tables
Use this method when the init-file procedure cannot be completed, such as when you cannot arrange the startup file but can control the server process. It disables the privilege system while the temporary server is running. MySQL also enables skip_networking, so the server accepts local connections only.
Start an isolated temporary server
- Stop MySQL if it is running. Do not launch a second process against the same data directory while the normal instance is active.
- Start the server with
--skip-grant-tables. Keep the process on the local machine and retain the normal configuration options needed to identify the correct data directory. Because this mode is unsafe, do not expose a temporary listener or leave the process unattended. - Connect with the MySQL client without a password. Use a local socket or local connection to the temporary instance, for example:
mysql -u root
Re-enable account-management statements, then change the password
In this mode, MySQL does not read the grant tables and disables account-management statements such as ALTER USER and SET PASSWORD. The first SQL statement must therefore be:
FLUSH PRIVILEGES;After the flush succeeds, change the account password:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
ALTER USER 'root'@'localhost' IDENTIFIED BY 'MyNewPass';Adjust 'localhost' if the root account uses another host part. Account-management statements apply privilege changes immediately; you do not need to edit grant tables directly.
Return to the authenticated configuration
- Exit the client and stop the temporary server.
- Start MySQL normally. Remove
--skip-grant-tablesand do not retainskip_networkingfrom the recovery start. - Test the new password locally. Use the ordinary client command with
-pand verify that the expected instance accepts it. - Check the service definition. A persistent option in a unit file, script, container entrypoint, or configuration file can silently put the server back into recovery mode on the next restart.
Why ALTER USER fails in recovery mode
The failure is normally a consequence of the mode, not a bad password. --skip-grant-tables tells MySQL not to read the grant tables and to start without the privilege system. As a result, account-management statements are disabled until you run FLUSH PRIVILEGES;.
The required order is therefore:
FLUSH PRIVILEGES;ALTER USER 'root'@'localhost' IDENTIFIED BY 'MyNewPass';
Run both statements in the same temporary local session, then restart without the unsafe option. If you try ALTER USER first, the server can reject it because account management has not been re-enabled.
Why mysqladmin password may not work
mysqladmin password does not apply a password change while the server is running with --skip-grant-tables. Flush privileges first, then use an account-management statement such as ALTER USER. This avoids relying on a password-change command that the recovery mode does not permit.
Once MySQL has been restarted normally, ordinary password-management commands operate under the normal privilege system. The recovery sequence itself should still use the explicit FLUSH PRIVILEGES followed by ALTER USER.
The host part of the root account is significant
MySQL identifies an account by the pair user and host, not by the username alone. The commonly documented example is 'root'@'localhost', which matches a local root account. An account such as 'root'@'127.0.0.1', 'root'@'::1', or another host pattern is a different account.
Best Value
If you alter 'root'@'localhost' when the active account has another host component, the command may target the wrong account or fail because that account does not exist. Determine the host part from the installation’s account configuration and substitute it consistently in the init file, the recovery command, and your login test.
Account changes, grant tables, and FLUSH PRIVILEGES
Statements such as ALTER USER and SET PASSWORD are account-management statements. Changes made through them are loaded immediately. Direct edits to grant tables are a different operation and require FLUSH PRIVILEGES or a server restart before MySQL uses the edits.
For a lost root password, do not edit grant tables directly. The documented recovery uses ALTER USER; in skip-grant-tables mode, FLUSH PRIVILEGES is required first only to re-enable that statement class.
Troubleshooting by symptom
| Symptom | Likely cause | Corrective action |
|---|---|---|
ALTER USER is rejected while using --skip-grant-tables |
Account-management statements are disabled in this mode | Run FLUSH PRIVILEGES; in the local client, then run ALTER USER |
| The new password works for one connection but not another | The connections resolve to different host entries or different MySQL instances | Verify the account’s host component, socket/port, data directory, and service instance; retest the intended path |
| Remote clients cannot connect during recovery | --skip-grant-tables enables skip_networking |
Use a local client for the reset, then restart normally before testing remote access |
| MySQL starts once but later reports data-directory permission errors | The temporary daemon was started as root without the normal MySQL user | Stop it, restore ownership and permissions as required by the installation, and start as the normal service account or with the correct --user option |
| The service starts with the old behavior after a successful reset | The temporary startup option remains in a service definition or script | Remove --init-file, --skip-grant-tables, and any unintended skip_networking setting, then restart through the normal service manager |
| The password is still exposed after recovery | The init file was not removed | Delete the file and verify that backups, temporary copies, and shell history do not contain the replacement secret |
Service managers, containers, and vendor packages
The documented procedure does not provide one universal stop/start command for systemd, launchd, Docker, or every vendor-managed MySQL package. The service wrapper may supply the executable path, defaults file, data directory, socket, user, and environment variables. Substitute that environment’s commands while keeping the essential order:
- Stop the normal instance.
- Start one temporary instance with the required recovery option.
- Perform the password change locally.
- Remove the temporary file or option.
- Stop the temporary instance.
- Start the normal service and verify authentication.
For containers, make sure the temporary process uses the same persistent data volume as the original instance and that the container entrypoint does not automatically launch a second server. For packaged services, inspect the effective startup configuration rather than assuming the binary’s default paths.
Quick Recap
Final security checklist
- Use the init-file method whenever you can control a clean restart.
- If skip-grant-tables is unavoidable, keep the server local and unattended time to a minimum.
- Run
FLUSH PRIVILEGESbeforeALTER USERin that mode. - Change the correct
user@hostaccount. - Delete every init file containing the new password.
- Restart without
--skip-grant-tables,--init-file, and unintendedskip_networking. - Test with the normal client path and confirm that the expected MySQL instance, not a second local instance, accepted the password.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
