What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
The message Access denied for user 'localhost'@'localhost' (using password: NO) means the MySQL client attempted to authenticate as the user localhost, from the client host localhost, without sending a password. It does not prove that the MySQL account has no password. In most cases, retrying with -p, removing hidden client defaults, and making the username-and-host account row match the connection path resolves the problem.
Work through the checks in order. They begin with the least disruptive explanation—a missing password prompt—and progress to account, host, authentication-plugin, and password-recovery issues.
As an Amazon Associate I earn from qualifying purchases.
What the error actually says
MySQL reports three pieces of information in an access-denied message: the account name it tried, the client host it identified, and whether the client sent a password. Oracle’s MySQL Reference Manual describes this as a statement of who you are trying to log in as, where the connection came from, and whether a password was used.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errors| Message portion | Meaning |
|---|---|
user 'localhost' |
The username supplied to the client. If you intended to use another account, the -u value is wrong. |
@'localhost' |
The client host as presented to MySQL. This is separate from the username. |
using password: NO |
The client sent no password in this attempt. It does not describe the password stored for the account. |
A common mistake is to read the first localhost as the server address. In MySQL account notation, the first value is the user and the value after @ is the host. If you ran mysql -u localhost, you explicitly asked to log in as a user named localhost. If your real account is named appuser, use mysql -u appuser -p instead.
#1 Best Overall
Fix the login in the safest order
1. Retry with an interactive password prompt
Run the client with the intended username and a separate -p option:
mysql -u USER -pReplace USER with the actual MySQL account name. Wait for the Enter password: prompt, then type the password. The characters normally remain invisible while you type.
Do not append the real password to the command, such as -pMyPassword. A password written on the command line can be exposed through shell history, process listings, transcripts, or support logs. The prompt keeps it out of the command text.
Recommended Free Tools
If the account is deliberately configured without a password, use the MySQL client’s documented explicit no-password mode for your installed release. Do that only when passwordless authentication is an intentional, controlled configuration; switching to no-password mode merely to silence this error weakens authentication.
2. Eliminate hidden option-file and environment settings
MySQL clients can load options from configuration files and environment variables. An old default can silently replace the username, host, port, socket, or password you thought you supplied. To test a clean invocation, bypass option files:
mysql --no-defaults -h localhost -u USER -pEnter the password at the prompt. If this works while the ordinary command fails, inspect the client option files and environment used by the failing shell or application. Look for entries such as user, password, host, port, and socket. Remove or correct stale values, then retry without --no-defaults to confirm that the normal configuration is now consistent.
The clean test is diagnostic, not a permanent requirement. Some installations intentionally rely on an option file for a socket path or account name, so preserve settings that are correct and remove only obsolete credentials or connection overrides.
3. Test the local socket and TCP paths separately
localhost is a local-host synonym, and MySQL commonly uses the local Unix socket when it is specified. 127.0.0.1 explicitly requests TCP/IP. They can therefore select different server listeners and different User/Host account rows.
| Test | Connection path selected | What a different result tells you |
|---|---|---|
mysql -h localhost -u USER -p |
Typically the local socket on Unix-like systems, depending on client configuration. | A success here points to a socket-based account or configuration that is not equivalent to TCP. |
mysql -h 127.0.0.1 -u USER -p |
TCP/IP to the IPv4 loopback address. | A success here points to a TCP listener or a host row that differs from the socket connection. |
Run both commands with the same username and password. Record which one succeeds. Do not assume that changing the spelling of the host is cosmetic: the server’s account matching rules treat the connection origin as part of authentication.
If an application uses a socket but you tested TCP, configure the application to use the successful socket path. If it must use TCP, make the TCP-selected account row and authentication settings correct instead of granting broad access to every host.
4. Inspect the matching account row
You need an administrative connection for this query. Once connected, inspect the account name, host value, and authentication plugin:
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →SELECT User, Host, plugin
FROM mysql.user
WHERE User = 'USER';Replace USER with the username used by the failing client. Check whether a row exists for the exact host path. A row such as 'USER'@'localhost' is distinct from 'USER'@'127.0.0.1' and from 'USER'@'%'.
MySQL chooses the most specific matching host row. Consequently, adding only a wildcard account may not repair a localhost login when a more-specific localhost row already exists with a wrong password or incompatible authentication configuration. Inspect every row returned by the query before changing anything.
If the query returns no row for the intended user, verify the spelling and capitalization you used. A typo in -u can produce an access-denied message that looks like a password problem even though the expected account was never selected.
5. Repair or create the exact account securely
Use account-management statements rather than editing grant tables by hand. For an existing account whose password must be replaced:
ALTER USER 'USER'@'localhost' IDENTIFIED BY 'a-new-strong-password';If the exact account does not exist and your administrative policy allows creating it:
CREATE USER 'USER'@'localhost' IDENTIFIED BY 'a-new-strong-password';Use the host that corresponds to the connection path you intend to support. If the application connects over TCP to 127.0.0.1, an account for localhost may not be the row that is selected; create or alter the appropriate host-specific account instead.
Grant only the privileges the application needs. For example, an application that must read and modify tables in one database might receive a narrowly scoped grant:
GRANT SELECT, INSERT, UPDATE, DELETE
ON database_name.* TO 'USER'@'localhost';Replace the database and account names with your values, and remove privileges your application does not require. Avoid using a wildcard host such as 'USER'@'%' merely because it is convenient. A wildcard can allow connections from more origins than intended and can conceal a mismatch between the application’s actual path and its account configuration.
If someone edited grant tables directly on an older or specially managed installation, reload the tables with the appropriate administrative command, such as FLUSH PRIVILEGES or mysqladmin flush-privileges. Statements such as CREATE USER, ALTER USER, and GRANT normally update the privilege system through the supported interface, so do not add an unnecessary reload simply as a ritual.
6. Verify the authentication plugin and client compatibility
The plugin column in the account query shows which authentication method the server expects. A client that is too old, incorrectly configured, or built without support for the account’s plugin can fail even when the password is correct. Compare the plugin shown for the working and failing account rows, and check that the client library used by your command-line tool or application supports the server’s configured method.
Do not change an authentication plugin blindly. First identify the client version and the server release, then use the release-specific MySQL documentation or your distribution’s guidance for a compatible migration. Changing the plugin can affect every application that uses the account.
7. Update the application’s own connection settings
A command-line login can succeed while an application still reports using password: NO because the application has its own configuration. Check the connection string, environment variables, secret store, service account, and deployment file used by that process.
Free tools Windows power users keep installed
One-click scans. No signup required.
- Confirm the application’s username is the same account you tested manually.
- Confirm a password is actually present and that an empty environment variable is not overriding it.
- Confirm the host value and port match the path you tested.
- Check whether the application forces a socket while your manual test used TCP, or the reverse.
- Restart the application after changing credentials so it discards a pooled connection created with the old settings.
Keep credentials out of source code and command history. Use the application’s supported secret-management mechanism and grant the service account only the database permissions it needs.
Best Value
When the account is intentionally passwordless
Some development or tightly controlled local setups intentionally use an account without a password. In that case, the error is caused by a mismatch between the client’s invocation and the account’s authentication configuration, not by a missing password that should be invented.
Confirm the account row, host, and authentication plugin with an administrator. Then use the client’s explicit no-password option documented for your release. Keep passwordless accounts limited to the required host and privileges, and do not reuse the pattern for a production service merely because it makes a local command convenient.
Why adding a wildcard host often fails
It is tempting to create 'USER'@'%' and assume every local connection will use it. MySQL host matching is more specific than that. A 'USER'@'localhost' row can take precedence for a socket or localhost connection, while a TCP connection may select another row. If the specific row has an old password, the wildcard row will not rescue the login.
Inspect the complete set of rows for the username, identify the row selected by the connection path, and fix that row directly. Use a wildcard only when connections from multiple hosts are a deliberate requirement and are protected by an appropriate network and privilege design.
Recovering a lost administrative password
If the password for the administrative account is genuinely unknown, stop guessing and follow the password-reset procedure for the exact MySQL release installed on the machine. Reset procedures are release-sensitive and can require controlled server startup, local access, and temporary authentication changes.
After a normal secure initialization, MySQL writes a generated initial password to the server error log. Locate that log and use the generated credential according to the release documentation. After an insecure initialization, the account starts without a password; MySQL identifies that configuration as a security risk. Set a strong password and complete the installation’s secure-initialization steps before allowing ordinary application connections.
Do not copy a reset command from instructions for a different release. Options, service names, authentication defaults, and recovery steps can change. Back up configuration and data as appropriate, restrict local access during recovery, and restore normal secure startup settings immediately after the password has been changed.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallConnection-path troubleshooting checklist
- Copy the complete error, including both values around
@and the password status. - Identify the intended username; do not assume the word
localhostin the message is the server address. - Retry with
mysql -u USER -pand enter the password at the prompt. - Repeat with
mysql --no-defaults -h localhost -u USER -pto remove hidden defaults from the test. - Test both
-h localhostand-h 127.0.0.1, recording which path works. - Using an administrative session, query
User,Host, andplugininmysql.user. - Alter or create the exact host-specific account, then grant only the required database privileges.
- Update the application’s own secret and host settings, and restart it if it pools connections.
- If the administrator’s password is lost, use the recovery procedure for the installed release and check the server error log for an initial generated password where applicable.
How to tell which fix worked
A successful command-line test should open the MySQL monitor without reporting access denied. Check the selected account and connection details from inside that session, then repeat the same host, port, and username from the application context. If the command-line login works only with --no-defaults, the remaining fault is configuration drift in an option file or environment. If it works only with one host spelling, the remaining fault is the account row or transport path used by the other spelling.
Once access is restored, remove temporary broad grants, delete obsolete credentials from option files, and document whether the application uses a socket or TCP. These cleanup steps prevent the next password rotation or client upgrade from recreating the same ambiguity.
Quick Recap
As an optional shortcut after the manual checks, Outbyte PC Repair can address more than 100 common Windows issues where possible, including broken system elements and shared DLL problems, while also offering settings tweaks, cleanup, privacy and vulnerability checks, a real-time boost, file shredding, and an app-crash log. It runs on Windows 11, 10, 8, and 7; its category-based free trial lasts at least two days before a paid subscription. It complements antivirus software rather than replacing it, and no tool repairs every crash.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
