Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
MySQL ERROR 1045 (28000), also called ER_ACCESS_DENIED_ERROR, means the server rejected a connection attempt. The cause is usually a wrong or stale password, an unexpected host, port, socket, or protocol, a client option file supplying old values, or an account row that does not match the connecting host. It is an authentication failure first—not automatically a database-privilege problem.
Fix it by copying the complete error, confirming the connection target, testing with explicit parameters, checking option files and login paths, and then verifying the server-side User/Host account match. Only change passwords or accounts when those checks identify the problem. The procedure below targets MySQL 8.0 and 8.4 clients and servers on Linux, macOS, and Windows; menus and service commands differ on managed database platforms.
As an Amazon Associate I earn from qualifying purchases.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
What does MySQL ERROR 1045 mean?
Error 1045 is MySQL’s connection-authentication error. The official error reference identifies it as ER_ACCESS_DENIED_ERROR, SQLSTATE 28000, with a message such as Access denied for user '%s'@'%s' (using password: %s) (MySQL Server Error Message Reference).
During connection verification, MySQL evaluates more than a username. It selects an account row using the presented username and the client host, then checks the credentials and account state. Consequently, app connecting through a local Unix socket, through TCP at 127.0.0.1, or from a remote machine can be matched to different rows and receive different results.
Popular on Amazon
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
The message itself is evidence. It tells you the username MySQL received, the client host it associated with the attempt, and whether the client sent a password. The phrase using password: YES means a password was supplied; it does not mean the password was correct. using password: NO means the client attempted the connection without sending one.
How should I read the complete error message?
Copy the entire line before changing anything. These examples point to different investigations:
Free tools Windows power users keep installed
One-click scans. No signup required.
ERROR 1045 (28000): Access denied for user 'root'@'localhost' (using password: NO)indicates that this invocation sent no password.ERROR 1045 (28000): Access denied for user 'root'@'localhost' (using password: YES)indicates that a password was sent, but it was rejected or the attempt matched an unexpected account row.- An error naming an IP address, a remote hostname, an empty host, or
unknownmeans the connection origin is not the local context you may have assumed.
Record the username, host, error code, SQLSTATE, and the final password flag. Do not post a real password, connection string, or secret-bearing configuration file in a support ticket or screenshot. The host shown in the error is especially important because localhost, 127.0.0.1, a Unix socket, and a remote hostname can select different MySQL accounts.
What should I check before changing a password?
First remove ambiguity from the client and application that failed:
- Identify the actual server. Confirm the environment, instance name, hostname or IP address, port, and database name. A development application can easily be pointed at a staging or production server with a different password.
- Identify the transport. Determine whether the client uses a Unix socket, TCP/IP, or a named pipe on Windows. A command that says
localhostmay use a socket, while127.0.0.1explicitly requests TCP. - Identify the credential source. Check the application settings, environment variables, secret manager, deployment file, GUI profile, or framework configuration that supplies the username and password. Do not rely on a password remembered from another server.
- Preserve the exact invocation. Note the executable, command-line switches, working environment, and operating-system account. Different MySQL client installations can read different configuration files.
- Check account state. If an administrator can connect, determine whether the intended account is locked or otherwise restricted before resetting credentials.
These checks often find the problem without any account change. MySQL’s connection troubleshooting guide emphasizes using the account and host shown by the error as diagnostic data (Troubleshooting Problems Connecting to MySQL).
How do I test MySQL with explicit host, port, and protocol values?
For the examples in this section, use a MySQL 8.0 or 8.4 client against a self-managed server on Linux, macOS, or Windows. Replace app and the host with your non-secret values. The -p switch prompts for the password; never put the password directly in a command line.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Test TCP explicitly:
mysql --no-defaults --protocol=TCP --host=127.0.0.1 --port=3306 --user=app -pOn Windows, the equivalent executable may be named mysql.exe:
Also popular on Amazon
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
mysql.exe --no-defaults --protocol=TCP --host=127.0.0.1 --port=3306 --user=app -pTo test a Unix socket on Linux or macOS, use the socket path configured by your installation:
mysql --no-defaults --protocol=SOCKET --socket=/path/to/mysql.sock --user=app -pThe path above is deliberately a placeholder; common distributions place the socket in different directories. Obtain the real path from the server configuration or service documentation rather than guessing.
Interpret the comparison:
- TCP succeeds but the normal command fails: the normal invocation is likely using a socket, a different host, a different port, or stale client options.
- The socket succeeds but TCP fails: the account may exist only for a socket-derived
localhostconnection, or the TCP listener and port may be different from what you expect. - Both fail with 1045: inspect the username, password, account host row, account state, and configuration sources.
- The client reports a connection or network error instead: the server may be stopped, listening on another port, blocked by a firewall, or unreachable. That is a transport problem rather than error 1045 authentication.
--no-defaults suppresses ordinary option-file loading for the test, allowing you to compare known values with the application’s defaults. MySQL documents an exception for .mylogin.cnf; therefore, a successful --no-defaults test does not prove that every credential source was bypassed (Using Option Files).
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsCould an option file or login path be supplying the wrong values?
Yes. MySQL programs can read option files and login paths containing settings such as host, user, password, port, and socket. A forgotten profile can make a command appear to ignore the values you believe you supplied.
Review the option-file groups used by the specific client, not just a system-wide file. Check user-level and installation-level files, environment variables, GUI connection profiles, and the encrypted login-path file. Look for an old hostname, a nonstandard port, a socket path from an earlier installation, or a username that differs by one character.
Run a controlled comparison:
- Use an explicit command with
--no-defaults,--host,--port,--protocol, and--user. - Run the ordinary command or application connection that fails.
- If only the ordinary invocation fails, identify which option files, login paths, environment variables, or application settings it reads and remove or correct the stale entry.
- Retest without exposing the password. Keep secrets in the prompt or approved secret store.
Do not edit a file blindly: multiple MySQL installations may exist, and a service account can read a different file from your interactive shell. The option-file documentation explains file locations, processing order, and client-specific groups.
How does MySQL match the username and host?
Use a separate administrative connection to inspect the server-side account definitions for the exact username shown in the error. On MySQL 8.0 and 8.4, an administrator can run a query such as:
Also popular on Amazon
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
SELECT User, Host, plugin, account_locked
FROM mysql.user
WHERE User = 'app';This is an inspection example, not a command to run with an untrusted account. Replace the value with the intended username and execute it only from an authorized administrative session.
Compare the returned User and Host values with the connection that failed. A row for 'app'@'localhost' does not automatically authorize app from another machine. A connection over TCP may match a different row from one that uses a local socket, even when the command contains the same username.
Pay attention to overlapping rows. MySQL’s matching rules can prefer a more-specific host entry such as localhost over a broad wildcard entry such as %. An administrator may therefore inspect the wildcard row and change it while MySQL continues selecting the more-specific row. Anonymous-user rows and unexpected hostname resolution can create similarly surprising matches. The official connection-verification documentation describes this selection process (Access Control, Stage 1: Connection Verification).
Do not add 'app'@'%' as a reflex. A broad host wildcard expands where the account can be used and may expose a service unnecessarily. Create the narrowest host entry that matches the real deployment, and account for network controls, TLS requirements, and the service’s topology before permitting remote access.
What if the password is wrong or was changed recently?
Change the password only after confirming that the username, target server, client host, and account row are correct. If the application recently changed its secret, update every consumer that uses the account: connection pools, environment variables, scheduled jobs, migration tools, and GUI profiles. A successful manual login does not update those copies automatically.
For a MySQL 8.x account, an authorized administrator can use the release-supported account-management syntax, for example:
ALTER USER 'app'@'localhost' IDENTIFIED BY 'use-a-new-secret-here';Use the actual matching Host value, verify the syntax for your installed release, and keep the real secret out of shell history and documentation. If the account uses an authentication plugin or an external identity system, follow that system’s procedure instead of forcing a password change.
Also popular on Amazon
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Widely Compatible: Transform any USB-C port into a USB-A port and USB-A port into a USB-C port, and connect up a wide range of USB-C(including MacBook, iPad Pro/Air/Mini, iPhone models with USB C ports, Samsung Galaxy series, and Google Pixel series. ) and USB A devices(including external hard drives, phones, mice, printers, and more)
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
After changing a credential, test the same protocol, host, port, and account context used by the application. Then rotate the secret in the application or secret manager and restart or refresh connection pools as required by that software.
How do I tell authentication failure from a privilege error?
Authentication is the first stage: MySQL must establish a session by matching the client host and username and validating the account. Authorization is the later stage: after login, MySQL checks whether that authenticated account may select a database, read a table, execute a routine, or perform a statement. MySQL documents this separation in its connection-verification and request-verification chapters (Stage 1; Stage 2).
If mysql -u app cannot establish a session and returns 1045, changing database grants is not the first remedy. If login succeeds but USE database_name; or a query returns an access-denied message for a database object, inspect grants instead:
SHOW GRANTS FOR 'app'@'localhost';For a successful session, SELECT USER(), CURRENT_USER(); can help distinguish the credentials presented by the client from the account row MySQL actually selected. Run it only after login and interpret the result with the account-matching rules in mind.
What should I do if I forgot the root password?
Root-password recovery is platform- and installation-specific. Use the official procedure that matches your MySQL release, operating system, service manager, and installation method; MySQL provides separate guidance for Unix-like systems and Windows (How to Reset the Root Password).
The safe sequence is:
- Confirm ownership and impact. Make sure you control the server and have a maintenance window. On a managed database service, the provider may control the server process and offer a dashboard or documented reset instead.
- Stop or isolate the normal server. Prevent competing starts and restrict local or network access during recovery.
- Start the documented recovery mode. Use the exact release and operating-system instructions. Recovery mode changes normal access controls and should be treated as a temporary administrative state.
- Connect through the permitted local method. Change the intended administrative account password using the supported account-management operation.
- Stop the special-mode process. Do not leave a recovery-mode server running after the password change.
- Restart normally and verify. Confirm that ordinary authentication, networking, logs, and service startup behavior have returned, then test the application with its updated secret.
Do not copy a single recovery command block from an unrelated tutorial. Service names, data directories, privilege requirements, and recovery options vary, and the server’s operating-system user matters. If you cannot identify the installation method or safely isolate the instance, involve the platform administrator rather than experimenting on a production server.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What changes when MySQL is managed by a hosting provider?
On a managed MySQL service, you may not have permission to stop the server, start recovery mode, inspect system tables, or alter the provider’s administrative account. Use the provider’s documented password-reset, user-management, network-allowlist, and connection-parameter controls. Gather the exact 1045 message, endpoint, port, username, client source address, and connection method for support.
Also popular on Amazon
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
Do not apply self-managed recovery instructions to a managed instance. The provider may reject those commands, and attempting to bypass its control plane can interrupt service or violate its operating model. If you need to avoid maintaining account, host, and recovery settings yourself, a managed MySQL service is an architectural choice—not a substitute for diagnosing which credential and host the application is actually using.
Why do common “fixes” fail?
- Changing grants first: privileges cannot repair a username, password, host, or protocol mismatch that prevents login.
- Assuming
localhostequals127.0.0.1: they can select different account rows and use different transports. - Adding a wildcard host:
%may broaden exposure and still lose to a more-specific row. - Editing one configuration file: the failing client may read another file, login path, environment variable, or application profile.
- Resetting a managed-service root account: the provider controls the process and normally supplies a supported workflow.
- Leaving recovery mode active: normal access controls may be bypassed until the special process is stopped and the service is restarted normally.
- Publishing real credentials: passwords in logs, screenshots, source control, or command history become a separate security incident.
What is the fastest safe decision tree?
Use this order so each test answers one question:
- Does the message show
using password: NO? Supply the intended password through a prompt or secret store and check the client configuration. - Does the host in the message differ from the intended origin? Correct the host, port, protocol, socket, container network, or forwarding configuration before changing accounts.
- Does an explicit
--no-defaultstest work? Inspect option files, login paths, environment variables, and application defaults. - Does the server have a matching
User/Hostrow? If not, create or correct the account through approved administration, using the narrowest host scope. - Is the row correct but the credential unknown or stale? Change it with the supported syntax for the installed release, then update every application secret.
- Does login now succeed but the original query fail? Stop troubleshooting authentication and inspect grants, object ownership, and request authorization.
This sequence separates observation from higher-risk account changes. It also leaves an audit trail: the exact error, explicit connection test, configuration comparison, account match, and final application test.
What should I verify after ERROR 1045 is fixed?
Repeat the connection using the same host, port, protocol, socket, username, and database that the application uses. Confirm that the application no longer falls back to an old secret, and check connection-pool logs after a restart or secret refresh.
Remove temporary diagnostic files and redact credentials from logs. Review account host scope, disable unused accounts, avoid shared administrative credentials, and grant only the permissions the application needs. If you used a recovery procedure, verify that the normal service starts at boot and that the temporary recovery process is gone. Finally, document the canonical endpoint and credential source so the next deployment does not silently reintroduce the mismatch.
For a broader Windows-maintenance shortcut after you complete the MySQL checks, Outbyte PC Repair can address certain common Windows issues and system clutter, but it does not replace MySQL account administration or antivirus protection; results vary and no utility repairs every crash. It runs on Windows 11, 10, 8, and 7, with a category-based free trial of at least two days before a subscription.
Conclusion
MySQL 1045 is best treated as a diagnostic decision tree, not a one-command repair. Start with the complete error, make the connection target explicit, isolate option-file behavior, and verify the server’s username-and-host match. Change credentials only when the evidence points there, keep authentication separate from authorization, and use the version-specific recovery procedure for a forgotten administrative password. Restoring normal service operation and removing temporary recovery access are part of the fix.
Recommended Free Tools
Frequently Asked Questions
Why does MySQL still say access denied after I changed the password?
The client may still be sending an old secret from an option file, login path, environment variable, connection pool, or GUI profile. It may also be connecting to a different host or matching a different User/Host row than the one whose password you changed.
Is MySQL access denied caused by a firewall?
A firewall or stopped listener usually produces a timeout, refusal, or other connection error rather than SQLSTATE 28000. Once the server receives the connection and returns error 1045, focus first on credentials, account matching, and client settings.
Can I fix ERROR 1045 by using the root account remotely?
Do not enable broad remote-root access merely to bypass the error. Use a narrowly scoped administrative account or the managed service’s supported controls, and restrict host access according to your deployment and security requirements.
How can I see which MySQL account actually matched my login?
After a successful connection, run SELECT USER(), CURRENT_USER();. USER() reflects the client identity and origin presented by the connection, while CURRENT_USER() shows the server account row used for privilege checks.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
