The message ERROR 1045 (28000): Access denied for user 'admin'@'localhost' (using password: YES) means MySQL or MariaDB rejected the account identity it matched for admin connecting from localhost. A password was sent, but the message does not prove that the password itself is the only problem. The server may be matching a different host row, using an authentication plugin your client cannot negotiate, or refusing a locked or otherwise invalid account.
Work through the checks in order: record the exact connection path, inspect the admin account rows with an existing administrator login, reset the password for the correct User plus Host pair, verify the authentication method and account state, then test the same socket or TCP path used by the application. If nobody can administer the server, use a short, controlled skip-grant-tables recovery and remove it before returning the server to normal operation.
| # | Preview | Product | Price | |
|---|---|---|---|---|
| 1 |
|
Murach's MySQL: Training & Reference | $35.99 | Buy on Amazon |
| 2 |
|
MySQL Pocket Reference | $2.34 | Buy on Amazon |
| 3 |
|
MySQL(TM): The Complete Reference | $39.72 | Buy on Amazon |
| 4 |
|
MySQL Commands Cheat Sheet Reference Guide – Beginner to Advanced | Essential MySQL Commands for... | $14.99 | Buy on Amazon |
| 5 |
|
Mysql Administrator's Guide an dLanguage Reference | $19.36 | Buy on Amazon |
As an Amazon Associate I earn from qualifying purchases.
What “using password: YES” and error 1045 actually mean
MySQL documents that an Access denied message identifies the account name, the client host, and whether the client supplied a password. Therefore, using password: YES only tells you that a password was presented. It does not tell you that the password is wrong, and it does not identify which account row was selected.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →MySQL and MariaDB authenticate an account as a user-and-host pair. These are separate matching cases:
#1 Best Overall
'admin'@'localhost''admin'@'127.0.0.1''admin'@'::1''admin'@'%'
A password changed for one pair does not automatically change another. A more-specific host row can also take precedence over a wildcard row, so an apparently correct admin@'%' account may never be used for a local connection. Host-name resolution settings such as skip_name_resolve can further change which host values are valid.
Capture the exact connection context first
Do not change grant tables until you know what is failing. Write down the following from the command, application configuration, or control panel:
- Whether the server is MySQL or MariaDB.
- The exact server version, obtained with
SELECT VERSION();if any administrative session is available. - The operating system and the service instance being used. Multiple MySQL or MariaDB services can be installed on one machine.
- The client command or application that displays the error.
- Whether the connection uses the local Unix socket or named pipe,
127.0.0.1,localhost, or::1. - Whether a panel such as Plesk keeps its own copy of the database password.
On many MySQL clients, mysql -u admin -p with no -h uses the local socket on Unix-like systems. On Windows, the client may use a named pipe or TCP depending on its defaults. Explicitly specifying -h localhost, -h 127.0.0.1, or -h ::1 can select a different account row. Reproduce the failing path rather than testing only a convenient alternative.
How MySQL chooses the account row
The visible username is only half of the login identity. The server compares the supplied user and the connection’s source host with rows in its account tables. That is why changing admin@localhost may have no effect on an application configured for an IPv4 loopback address. Conversely, a successful socket login does not prove that TCP clients have a usable account.
Host matching can also explain an apparently contradictory result. A broad 'admin'@'%' row and a specific 'admin'@'localhost' row can coexist, but the more-specific match can be selected for a local connection. The wildcard row may have a different password, plugin, lock state, or grants. Treat each host value as an independent account that must be checked and maintained.
If the server uses skip_name_resolve, host names are not handled in the usual way and account rows based on names may not match as expected. Use the actual address form required by that server configuration and avoid adding extra rows until you understand which path the client is using.
Fix the account when another administrator can log in
1. List every host row for the user
Open an administrative MySQL or MariaDB session and inspect the account rows for admin:
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsSELECT User, Host
FROM mysql.user
WHERE User = 'admin';The result should show whether the required host row exists. A row for admin@localhost is different from a row for [email protected]. Do not assume that a wildcard row is a safe substitute. MySQL warns that wildcard host entries can be insecure and can be shadowed by a more-specific local row.
Some releases expose additional account-state columns in mysql.user, while others represent them differently. If the following query is supported by your release, it can help identify a locked account or authentication plugin:
Rank #2
- Used Book in Good Condition
SELECT User, Host, plugin, account_locked
FROM mysql.user
WHERE User = 'admin';If that query fails because a column is not present, use the basic User and Host query and inspect the account definition with SHOW CREATE USER instead. Avoid editing rows in the grant tables directly unless the vendor documentation for that old release specifically requires it.
2. Confirm that you are inspecting the right server
A surprisingly common mistake is changing one database service while the application connects to another. Compare the service name, port, socket path, and version reported by the administrative session with the values in the failing application. Run SELECT VERSION(); and note whether the result is MySQL or MariaDB. On a host with more than one installation, a command-line client in one installation can connect to a different socket or service than the panel uses.
Do not infer the server from the client program name alone. Capture the exact command or connection string, including any explicit host, port, socket, or named-pipe setting. Repeat the account query against that same endpoint whenever possible.
3. Reset the password for the exact account
When the row exists and you have an administrative session, use the supported account statement and include both parts of the identity:
ALTER USER 'admin'@'localhost'
IDENTIFIED BY 'new-strong-password';Replace the example password with a unique, long value and protect it as you would any other administrator credential. The account targeted by ALTER USER is the row whose User and Host values match the statement. If the application actually connects through TCP loopback, reset or create the corresponding [email protected] account instead; do not change unrelated host rows just to make a test pass.
If no matching account exists, create only the host-specific account required by the application, using syntax supported by the detected server version:
CREATE USER 'admin'@'localhost' IDENTIFIED BY 'new-strong-password';Creating an account does not grant it application privileges. Grant only the databases and operations the application needs, following your server’s least-privilege policy. Do not respond to a local authentication problem by granting unrestricted privileges to 'admin'@'%'.
Before creating a row, check whether a case or spelling difference is involved. The account named admin is not interchangeable with another username, and a host value written as a name is not the same troubleshooting target as an address value. Avoid creating duplicate-looking rows simply because one test used a different connection method.
4. Check the authentication plugin and account state
Display the complete account definition where supported:
Rank #3
SHOW CREATE USER 'admin'@'localhost';Look for a locked account, an expired credential, or an authentication plugin that the connecting client cannot negotiate. Client libraries bundled with older applications may not support the plugin selected by a newer server; conversely, MariaDB and MySQL do not expose identical plugin names or account syntax.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Choose the corrective statement from the documentation for the exact product and version returned by SELECT VERSION();. MySQL and MariaDB syntax is not interchangeable: do not copy MariaDB-only IDENTIFIED VIA clauses into MySQL, and do not assume that every release supports the same plugin names or account-lock options. If the account is locked, unlock it with the version-appropriate ALTER USER form. If the client is obsolete, upgrading the client library may be safer than weakening the server’s authentication method.
Do not change the plugin as a first reaction to every error 1045. First establish whether the same account works with a current command-line client. If a current client succeeds while an older application fails, the mismatch is likely in the application library or its supported authentication methods. Preserve the server’s stronger compatible method when upgrading the client is practical.
5. Verify privileges separately from authentication
A successful password check does not automatically grant database access. Once the account can log in, inspect its effective permissions with a host-qualified command such as:
SHOW GRANTS FOR 'admin'@'localhost';If the application then reports a permission error, that is a separate authorization problem rather than the original authentication failure. Grant only the required database and operations, and make the grant against the same host-specific account that the application uses. Avoid granting privileges to a wildcard account merely because it is easier to type.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
6. Test the same socket and TCP paths separately
After changing the account, test the path that failed and then test other local paths to expose host-row mismatches:
# Default local socket or named-pipe behavior
mysql -u admin -p
# TCP over IPv4 loopback
mysql -h 127.0.0.1 -u admin -p
# TCP over IPv6 loopback, when enabled
mysql -h ::1 -u admin -pEnter the new password when prompted. If the first command succeeds but the second fails, the server is probably matching different host rows; repair only the row needed for the failing connection. If all paths fail after a confirmed password change, recheck the selected service instance, account plugin, lock state, and whether a control panel or application is still supplying an old password.
Record which test succeeded, including the host spelling and whether a socket was used. This small record prevents a later password rotation from targeting the wrong identity. Test from the same machine and, when relevant, the same service account as the application; a shell login as an administrator may not reproduce the application’s connection path.
When no administrator can log in
Password recovery without an administrative session requires downtime and direct access to the database host. Schedule a maintenance window, notify users, and restrict access while privilege checks are disabled. The exact service name, configuration file, and startup commands vary by operating system and installation.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallControlled skip-grant-tables recovery
- Stop the MySQL or MariaDB service cleanly.
- Add
skip-grant-tablesto the server configuration for the maintenance start. Keep the interval as short as possible and restrict access to the local machine; while this option is active, normal privilege checks are bypassed. - Start the service in the maintenance mode and connect locally without a password using the client that matches the server installation.
- Run
FLUSH PRIVILEGES;before changing or creating the account. This reloads the grant tables for the recovery session. - Check the server version with
SELECT VERSION();, then use the matching MySQL or MariaDB syntax to alter or recreate the requiredadmin@localhostaccount. If the application uses127.0.0.1or::1, repair that host-specific identity instead. - Grant only the privileges the application requires. Avoid broad wildcard-host grants.
- Exit the client, stop the service, remove
skip-grant-tablesfrom the configuration, and start the service normally. - Run the socket and TCP tests again, and confirm that the production service is enforcing authentication.
Never leave skip-grant-tables enabled. Anyone who can reach the maintenance instance may otherwise bypass normal account and privilege checks.
Keep a copy of the original configuration before the temporary change, and verify the effective startup configuration after the normal restart. A forgotten option in a second configuration file can leave the server in recovery mode even when the primary file appears clean. Check the service status and perform an authenticated login after the restart rather than assuming that a successful process start means the security settings are restored.
Plesk-managed installations
Plesk’s documented recovery procedure separates MySQL 5.7/8.0 from MariaDB syntax. It likewise uses a temporary skip-grant-tables start, a local passwordless connection, FLUSH PRIVILEGES, a version-appropriate account change, a normal restart, and removal of the option. On Windows, after the database password is changed, update the password stored by Plesk as part of the same recovery so the panel and its managed services do not continue sending the old credential. The current Windows procedure is dated January 13, 2026; follow the instructions for the exact database engine and version installed on the server.
Do not mix commands from the MySQL and MariaDB sections of a panel procedure. First identify the engine and version, then follow the matching account syntax. Afterward, test both the panel-managed operation and a direct client login. If direct login works but Plesk still reports an error, its stored credential or managed connection target has not been updated.
Free tools Windows power users keep installed
One-click scans. No signup required.
Common causes and the right branch to take
| Symptom | Likely cause | Action |
|---|---|---|
admin@localhost fails, but [email protected] works |
Different host rows or socket-versus-TCP selection | Inspect every Host value and repair only the row used by the failing path. |
| A wildcard account exists, but local login still fails | A more-specific localhost row is selected, or the wildcard is invalid under host-resolution settings |
Create or alter the exact local account; do not rely on '%'. |
| Password was recently changed, but an application still fails | The application, service, or Plesk stores the old password | Update the application or panel credential, then restart only the dependent service if required. |
| Correct password is rejected by one client only | Authentication-plugin or client-library incompatibility | Compare SHOW CREATE USER with client support and use version-appropriate syntax or upgrade the client. |
| Every account is rejected and no administrator works | Lost credentials, locked account, damaged account state, or wrong service instance | Use controlled maintenance recovery, verify the service and version, and remove skip-grant-tables afterward. |
Pitfalls that make the outage longer
- Changing only the password text: A new password on the wrong host row cannot fix the selected account.
- Testing a different endpoint: A successful
localhostsocket test does not validate an application using127.0.0.1or::1. - Using a wildcard as a shortcut:
'%'expands exposure and may still be shadowed by a specific local row. - Mixing product syntax: MySQL and MariaDB releases differ in plugin names and account clauses.
- Editing grant tables blindly: Direct edits can be incompatible with the release; use
ALTER USERor the vendor’s documented recovery method. - Forgetting stored credentials: A panel, scheduled job, service, or application may continue retrying the old password after the database account is fixed.
- Leaving recovery mode active:
skip-grant-tablesbypasses normal checks and must be removed before normal service resumes.
Security checks after the login works
- Remove
skip-grant-tablesand restart normally if you used recovery mode. - Confirm that the server is listening on the intended interfaces and that no temporary maintenance configuration remains.
- Keep administrative accounts host-specific where possible. Replace unnecessary wildcard hosts with narrowly scoped entries.
- Check the application configuration, scheduled jobs, service accounts, and Plesk for stale copies of the old password.
- Review grants with
SHOW GRANTS FOR 'admin'@'localhost';and remove privileges that the account does not need. - Record the working connection path—socket,
127.0.0.1, or::1—so future password changes target the same account identity. - Retest the application after the database client test, because an application may use a different host, library, or stored credential.
Frequently asked questions
Does “using password: YES” prove that my password is wrong?
No. It proves that the client sent a password. The server may have selected a different host row, found a locked account, or rejected an authentication plugin that the client cannot use.
Why does admin@localhost differ from [email protected]?
They can use different connection mechanisms and match different Host values. Each user-and-host pair can have its own password, plugin, lock state, and privileges.
Should I create admin@'%' to make the error disappear?
Usually not. A wildcard host can expose the account more broadly and may be shadowed by a more-specific local row. Identify the application’s actual path and create or repair only that host-specific account.
What command should I use to change the password?
With an administrative session, use a version-supported statement such as ALTER USER 'admin'@'localhost' IDENTIFIED BY 'new-strong-password'; Include the exact host value that the client matches.
Recommended Free Tools
Why does SHOW CREATE USER matter?
It can reveal the account’s authentication method and state. That helps distinguish a password issue from a locked account or a client-library incompatibility.
Best Value
What if the account query shows no admin row?
Create only the required host-specific account with syntax supported by the detected MySQL or MariaDB version, then grant the minimum privileges the application needs. Do not assume that creating the account also grants database access.
Can I leave skip-grant-tables on until I finish testing?
No. It bypasses normal privilege checks. Use it only during a controlled maintenance interval, then stop the service, remove the option, restart normally, and perform an authenticated test.
Why does Plesk still fail after I reset the database password?
Plesk may retain its own copy of the credential. Update the stored Plesk password as part of the recovery, especially on Windows, and test the panel-managed connection separately.
Optional Windows-side shortcut
If this database error appears alongside broader Windows component failures, Outbyte PC Repair is an optional shortcut that can address certain common Windows issues and application-crash conditions; it complements antivirus software, does not replace it, cannot guarantee a MySQL authentication repair, and results vary. It runs on Windows 11, 10, 8, and 7, with a free trial by category of at least two days followed by a paid subscription.
Frequently Asked Questions
What does MySQL error 1045 mean?
The server rejected the supplied user-and-host identity. “Using password: YES” means a password was sent, not necessarily that the password alone is incorrect.
How do I fix an admin localhost password rejection?
Inspect all rows for User=’admin’, reset the exact host-qualified account with ALTER USER, check its plugin and lock state, and retest the same socket or TCP path used by the application.
Why does 127.0.0.1 work while localhost fails?
The two connections can match different Host rows. Repair the row for the path that actually fails instead of changing an unrelated account.
What should I do if no administrator can log in?
Use a controlled maintenance window with temporary skip-grant-tables, run FLUSH PRIVILEGES, repair the version-appropriate account, remove the option, restart normally, and verify authenticated access.
Is a wildcard admin account safe?
It can broaden exposure and may be shadowed by a more-specific localhost row. Prefer the narrow host value required by the application.
Why does Plesk still use the old password?
Plesk can store a separate database credential. Update that stored value after changing the database account, particularly on Windows.
The Bottom Line
Error 1045 is an account-identity problem, not automatically a bad-password problem. Match the exact user and host, inspect the selected row, use version-appropriate account syntax, verify plugin and lock state, and test the same socket or TCP endpoint as the application. If recovery mode is necessary, keep skip-grant-tables temporary and remove it before normal service resumes.
Free tools Windows power users keep installed
One-click scans. No signup required.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
