How to Fix MySQL Access Denied for User Error

In this tutorial, you'll learn about How to Fix MySQL Access Denied for User Error. We cover key concepts, practical examples, and best practices.

The Problem

You try to connect to MySQL and get:

ERROR 1045 (28000): Access denied for user 'appuser'@'localhost' (using password: YES)

MySQL rejected the connection because the credentials are wrong, the user does not exist for that host, or the authentication plugin is incompatible.

Quick Fix

1. Reset the user password

Connect as root and reset the password:

sudo mysql -u root

ALTER USER 'appuser'@'localhost' IDENTIFIED BY 'new_strong_password';
FLUSH PRIVILEGES;

For MySQL 5.7 and older:

SET PASSWORD FOR 'appuser'@'localhost' = PASSWORD('new_strong_password');
FLUSH PRIVILEGES;

2. Check the host part of the user

A user appuser created for '%' (any host) may not match localhost:

SELECT user, host FROM mysql.user WHERE user = 'appuser';

If the output shows appuser | % but no appuser | localhost, MySQL uses the anonymous ''@localhost user. Create a localhost entry:

CREATE USER 'appuser'@'localhost' IDENTIFIED BY 'password';
GRANT ALL PRIVILEGES ON mydb.* TO 'appuser'@'localhost';
FLUSH PRIVILEGES;

3. Grant proper privileges

The user may exist but lacks privileges on the target database:

SHOW GRANTS FOR 'appuser'@'localhost';

-- Grant access if missing
GRANT SELECT, INSERT, UPDATE, DELETE ON mydb.* TO 'appuser'@'localhost';
FLUSH PRIVILEGES;

4. Fix the auth plugin (MySQL 8+)

MySQL 8 defaults to <a href="/system-design/caching/">Caching</a>_sha2_password. Older clients expect mysql_native_password:

SELECT user, host, plugin FROM mysql.user WHERE user = 'appuser';

ALTER USER 'appuser'@'localhost' IDENTIFIED WITH mysql_native_password BY 'password';
FLUSH PRIVILEGES;

5. Force TCP or socket connection

The default localhost uses a Unix socket. Force TCP to test:

# Wrong — uses socket by default
mysql -u appuser -p

# Right — force TCP
mysql -u appuser -p -h 127.0.0.1

# Or specify socket explicitly
mysql -u appuser -p -S /var/run/mysqld/mysqld.sock

Prevention

• Use mysql_config_editor to store credentials securely.
• Create separate users per application with minimal privileges.
• Document the auth plugin requirement before upgrading MySQL.
• Test connections with the exact hostname and port used in production.

Common Mistakes with access denied

1. Using head and tail instead of pattern matching, causing runtime errors on empty lists
2. Forgetting that lazy evaluation defers computation until the value is forced, causing space leaks with unevaluated thunks
3. Using return to exit a function early instead of wrapping a pure value in the monad

These mistakes appear frequently in real-world MYSQL code. DodaTech's contributors have identified these patterns through analysis of open-source projects and production systems.

Practice Exercise

Write a pure function that safely divides two integers using Maybe, then test it with edge cases like division by zero and negative numbers.

This exercise reinforces the concepts covered in this guide. Try implementing it before checking online solutions.

FAQ