MySQL Error 1045: Access Denied for User (tested)

ERROR 1045 (28000): Access denied for user means the MySQL server rejected the username/password combination itself, before it even looked at what you're trying to do. It's purely an authentication failure. A related but different error, 1044, means the login succeeded but that user isn't authorized for a specific database — section 4 below shows the difference.

1. Reading the error

The full message tells you exactly what MySQL tried and what the client sent:

ERROR 1045 (28000): Access denied for user 'appuser'@'localhost' (using password: YES)

Three useful facts are packed in here: the username MySQL matched against ('appuser'), the host it thinks you're connecting from ('localhost'), and whether a password was sent at all (using password: YES or NO). That last part is the most useful: it tells you whether your client even tried to authenticate, or sent nothing.

2. Four reproduced cases (MySQL 8.4.11)

Note the third row: MySQL gives the identical error for a wrong password and for a user that doesn't exist at all. This is deliberate — it stops an attacker from using the error message to discover which usernames are valid.

3. The host part matters as much as the username

MySQL grants are scoped to a host pattern, not just a username. 'appuser'@'localhost' and 'appuser'@'127.0.0.1' and 'appuser'@'%' are three separate grants as far as MySQL is concerned, even though they look like the same user. In our fourth test case, root had no grant allowing a password-based login from 127.0.0.1 (only via the local Unix socket), so it failed even with a correct identity and no typo anywhere.

Check what's actually granted:

mysql> SELECT user, host FROM mysql.user WHERE user = 'appuser';
mysql> SHOW GRANTS FOR 'appuser'@'%';

4. 1045 vs 1044: authentication vs authorization

These are commonly confused but different problems. We reproduced both:

-- 1045: the login itself failed (wrong password, bad user, etc.)
ERROR 1045 (28000): Access denied for user 'appuser'@'localhost' (using password: YES)

-- 1044: login succeeded, but this user has no grant on this specific database
ERROR 1044 (42000) at line 1: Access denied for user 'appuser'@'%' to database 'mysql'

If you see 1044, the username and password are fine — the fix is a GRANT, not a password change:

mysql> GRANT SELECT ON mysql.* TO 'appuser'@'%'; FLUSH PRIVILEGES;
-- after the grant, the same query that failed now works:
mysql> USE mysql; SELECT 1;
1

5. Fixing 1045 itself

• Reset the password if you suspect it's simply wrong (tested, works immediately without restarting the server):

  mysql> ALTER USER 'appuser'@'%' IDENTIFIED BY 'newpass123'; FLUSH PRIVILEGES;
  -- connecting with the new password now succeeds:
  $ mysql -uappuser -pnewpass123 -e "SELECT 1;"
  1

• Check the host you're connecting as, not just the username (section 3) — a grant for 'user'@'localhost' will not match a connection that MySQL sees as coming from a different host or IP, even on the same machine.
• Check the user exists at all: SELECT user, host FROM mysql.user; as root. A typo in the username produces the exact same 1045 as a wrong password (section 2, row 3), so don't assume the password is the problem.
• If this just started happening after an upgrade, MySQL 8's default authentication plugin (caching_sha2_password) isn't supported by some older client libraries, which can also surface as an access-denied error. Check your client library's MySQL 8 compatibility, or recreate the user with IDENTIFIED WITH mysql_native_password if you can't upgrade the client.

6. Don't over-fix: avoid blanket solutions

A common but risky "fix" circulating online is granting 'user'@'%' with all privileges to make the error disappear. That papers over whichever specific mismatch (wrong password, wrong host, missing grant) is actually happening, and widens the account's access far beyond what it needs. Diagnose with section 2's table first — the (using password: YES/NO) part alone usually tells you whether this is a credentials problem or a configuration problem.

Written with AI assistance. Measured on 2026-10-03 with MySQL 8.4.11 (official Docker image), using the mysql CLI. Every error message below is copy-pasted output, not paraphrased. PlainHeaders is our extension; MySQL and Docker are free.