MySQL Error 1045: Fix Access Denied for User

2026.09.05

DBA PARK may earn a commission from purchases through links in this article, at no extra cost to you.

MySQL Error 1045 means the server rejected the account during connection verification. Diagnose the exact 'user'@'host' shown in the error, whether a password was supplied, which account row matches that client host, and whether the account is locked or has authentication or TLS requirements. Do not respond by granting global privileges or weakening authentication.

ERROR 1045 (28000): Access denied for user 'appuser'@'10.10.20.15' (using password: YES)

using password: YES only means the client supplied a password; it does not mean the password was correct. MySQL accounts are identified by both user name and host, so 'appuser'@'localhost' and 'appuser'@'10.10.20.%' are different accounts.

Quick Decision Table

Observation Likely cause Next action
using password: NO The client did not supply a password. Use --password with no value so the client prompts securely.
Local connection works; remote connection fails A different user@host account matches, or no intended remote account exists. Inspect all rows for that user and the host shown in the error.
Correct password still fails after many attempts The account may be locked or the application may use stale credentials. Check account_locked, password state, and the configured secret source.
Older application fails; current MySQL client works The connector may not support the account’s authentication method or TLS requirements. Upgrade and configure the connector; do not downgrade authentication blindly.
Connection succeeds but a database or table is denied Authentication passed; Stage 2 privilege verification is failing. Inspect SHOW GRANTS and grant only the required privileges.

1. Reproduce with Explicit Connection Parameters

Test the same host, port, and user as the application. Let the client prompt for the password:

mysql --host=db01.example.com --port=3306 --user=appuser --password

Avoid -pYourPassword. Supplying a password on the command line can expose it through shell history or process inspection. Also check whether the application reads a different option file, login path, environment variable, or secret-store entry than your manual test.

2. Read the User and Host from the Error

The error reports the user name presented by the client and the client host seen by MySQL. Use an approved administrative session to find candidate account rows:

SELECT User, Host, plugin, account_locked, password_expired
FROM mysql.user
WHERE User = 'appuser'
ORDER BY Host;

Expected result: one or more rows such as 'appuser'@'localhost', 'appuser'@'10.10.20.%', or an exact host. Determine which row should match the failing client. Do not assume that a row for localhost authorizes remote connections.

3. Inspect the Account Definition

SHOW CREATE USER 'appuser'@'10.10.20.%';
SHOW GRANTS FOR 'appuser'@'10.10.20.%';

SHOW CREATE USER can reveal the authentication plugin, lock status, password-expiration policy, and TLS requirements. SHOW GRANTS answers a different question: what the account may do after authentication succeeds.

4. Fix the Exact Root Cause

Wrong or Stale Password

Rotate the password for the exact account row, update the approved secret store, and restart or reload only the application components that cache credentials.

ALTER USER 'appuser'@'10.10.20.%'
  IDENTIFIED BY 'replace-with-an-approved-generated-secret';

The example contains a placeholder. Do not put the real secret in source control, tickets, or a shared terminal transcript.

Locked Account

ALTER USER 'appuser'@'10.10.20.%' ACCOUNT UNLOCK;

Unlock only after finding why the account was locked. Otherwise, a service with stale credentials can immediately trigger more failures.

Missing Host-Specific Account

Create a new account only when the connection is intended and its source range is approved. Prefer a specific host or subnet over a broad wildcard.

CREATE USER 'appuser'@'10.10.20.%'
  IDENTIFIED BY 'replace-with-an-approved-generated-secret';

GRANT SELECT, INSERT, UPDATE, DELETE
ON appdb.*
TO 'appuser'@'10.10.20.%';

Do not use GRANT ALL ON *.* as a connectivity test. It changes authorization far beyond what Error 1045 requires.

Authentication Plugin or Driver Mismatch

Compare the plugin shown by SHOW CREATE USER with the connector version used by the application. The durable fix is normally to upgrade and configure the connector for the server’s supported authentication method. Changing the account to an older plugin can reduce security and may create a future upgrade blocker.

TLS Requirement

An account may require SSL, X.509, or certificate attributes. If SHOW CREATE USER includes a REQUIRE clause, configure the client accordingly and validate the server identity:

mysql --host=db01.example.com --user=appuser --password \
  --ssl-mode=VERIFY_IDENTITY \
  --ssl-ca=/path/to/approved-ca.pem

Do not switch to a verification-disabling mode as a permanent fix. Correct the CA trust, server certificate, and hostname.

5. Confirm Which Account Actually Matched

After a successful test, compare the identity supplied by the client with the account MySQL authenticated:

SELECT USER() AS client_identity,
       CURRENT_USER() AS authenticated_account;

If these differ unexpectedly, a more specific host row or an anonymous account may be taking precedence. Fix account definitions deliberately; do not drop rows until you understand their consumers.

Impact and Rollback

  • Password change: Applications using the old secret will fail until every secret copy is updated.
  • Plugin change: Some connectors may stop working; record the original SHOW CREATE USER output before editing.
  • Host change: New sources may gain access or existing sources may lose it; test from the real application host.
  • TLS change: Certificate and hostname validation can affect every client using the account.

For rollback, preserve the original account definition and grants in a protected administrative record, restore the former supported settings if necessary, and roll back the application secret as one coordinated change. Avoid dropping and recreating the account because that can lose attributes and grants.

Continue learning: To practice MySQL account management in a lab, browse Udemy and search for MySQL database administration courses with exercises on users, host matching, and privileges. To strengthen the SQL querying and relational database fundamentals behind your work, explore the interactive courses on DataCamp.

Related DBA PARK Guides

Official MySQL References