Free tools Windows power users keep installed
One-click scans. No signup required.
If you have lost the MySQL root password, the most controlled recovery is to start the server once with a protected initialization file containing an ALTER USER statement. Delete that file immediately after startup, then restart MySQL normally. If you cannot use an initialization file, the documented fallback is --skip-grant-tables: connect locally without a password, run FLUSH PRIVILEGES, change the password, and restart without the unsafe option.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
Choose the recovery method before changing anything
MySQL’s documented reset procedures use two temporary startup modes. The initialization-file method keeps normal authentication enabled while MySQL executes one password-changing statement during startup. The generic method, --skip-grant-tables, starts the server without its privilege system and is therefore an emergency measure.
As an Amazon Associate I earn from qualifying purchases.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problems| Characteristic | Initialization file | --skip-grant-tables |
|---|---|---|
| Windows support | Yes, with the Windows service stopped and restarted manually or through the service configuration | Yes, if you can start the server manually in the temporary mode |
| Unix/Linux support | Yes, using the account that normally runs MySQL | Yes, using a local client connection |
| Authentication during recovery | Remains enabled | Disabled; clients can connect without a password |
| Remote networking | Not disabled by the method itself | Disabled because MySQL enables skip_networking |
| Exposure | Limited to the startup interval, provided the file is protected | Anyone who can connect locally has unrestricted database access |
| Operational complexity | Requires creating a readable, protected file and supplying its path at startup | Requires a temporary unauthenticated server and a local client session |
| Cleanup | Delete the file, stop the temporary instance, and restart normally | Stop the temporary instance and restart without --skip-grant-tables or skip_networking |
Use the initialization-file procedure whenever you can stop the service and control its startup options. Use --skip-grant-tables only when that procedure is unavailable or cannot be made to work, and keep the temporary server isolated for the shortest possible time.
Check the account name and host component
MySQL identifies an account by both its user name and its host part. The commonly documented example is 'root'@'localhost', but your root account may use another host value. Change the host portion in every statement to match the account you actually need to reset. Resetting 'root'@'localhost' does not change a separate account such as 'root'@'127.0.0.1' or a root account tied to another host pattern.
#1 Best Overall
The password statement used by both procedures is:
ALTER USER 'root'@'localhost' IDENTIFIED BY 'MyNewPass';Replace MyNewPass with a new, unique password and replace localhost when the account’s host component differs. Treat the replacement password as sensitive information while you are working.
Reset the password on Windows with an initialization file
This is the preferred Windows sequence described in the MySQL Reference Manual. You need Windows Administrator access, permission to stop and start the MySQL service, and a location that the service account can read but ordinary users cannot.
1. Log on as a Windows Administrator
Use an account that can control the MySQL service and start the server process with its normal data-directory and configuration settings. If MySQL is installed as a service, identify the service’s normal executable and configuration before stopping it.
2. Stop the MySQL service
Stop MySQL through the Windows service-management method used by your installation. Do not leave the normal instance running while you start a second server against the same data directory.
3. Create a protected one-line file
Create a plain-text file containing exactly one account-management statement, including its terminating semicolon:
ALTER USER 'root'@'localhost' IDENTIFIED BY 'MyNewPass';Save the file in a directory readable by the MySQL service account. Restrict its permissions so other users cannot read it: the file contains the replacement password in clear text. The filename and location are up to you; the important requirements are that the path is correct, the service account can read it, and unauthorized users cannot.
4. Start MySQL with --init-file
Start the server once with the initialization-file option, preserving the ordinary options your installation needs. A command-line form is:
Rank #2
mysqld --init-file="C:securemysql-init.txt"Use the actual path to your server executable and initialization file. If your installation normally supplies a configuration file, data directory, or other startup options, include those as well. The server reads the file during startup and executes the ALTER USER statement.
5. Delete the file after successful startup
As soon as MySQL has started successfully and processed the statement, delete the initialization file. Do not keep it in the directory as a backup: anyone who can read it can obtain the new root password. If startup fails, keep the file only long enough to diagnose the path or permissions problem, then remove it and recreate it with restricted access.
6. Stop and restart MySQL normally
Stop the temporary server and start the MySQL service through its normal Windows configuration, without relying on the one-time --init-file option. The normal authenticated configuration must be the one that remains in service.
7. Test the new credentials
Connect with the MySQL client using the account and host you changed, supplying the new password when prompted. A successful authenticated connection confirms the reset. If it fails, do not repeatedly start additional instances; check that you changed the correct host component and that the normal service is using the same data directory as the temporary startup.
Reset the password on Linux or another Unix-like system
The Unix procedure is equivalent, but ownership and startup identity matter. Log in as the Unix account that normally runs MySQL, often mysql, rather than starting the database as an unrestricted system administrator.
1. Stop the running server
Stop MySQL using the service manager or launch method used by your deployment. The exact command is installation-specific; preserve the normal configuration and data-directory settings when you later restart it.
2. Create a protected initialization file
Create a file readable by the MySQL account and inaccessible to other users. Put this statement on one line, changing the host component if necessary:
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →ALTER USER 'root'@'localhost' IDENTIFIED BY 'MyNewPass';Store it outside shared or world-readable locations, and set ownership and permissions so the account that runs mysqld can read it. The file is temporary and contains the new password.
3. Start mysqld with the file
Start the server as the normal MySQL account with the initialization-file option:
mysqld --init-file=/path/to/mysql-init &Add normal options such as --defaults-file when your installation requires them. The command is a pattern, not a universal service command: use the same configuration, data directory, socket, and other settings as the stopped instance.
Do not start mysqld as root unless you also specify the correct --user=mysql behavior for your installation. Starting it as root can create root-owned files in the data directory, leaving the normal MySQL account unable to access them after recovery.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →4. Remove the file and return to normal startup
After the server has started and executed the statement, delete the initialization file immediately. Stop the temporary process, then start MySQL through its ordinary service or launch configuration, without the one-time --init-file option.
5. Verify the login
Use the local MySQL client with the account and host you changed. If the new password works against the normal instance, recovery is complete. If it does not, verify that the temporary process and the normal service used the same configuration and data directory, and that the account host value was correct.
Emergency recovery with --skip-grant-tables
This mode tells MySQL not to read the grant tables and therefore to start without its privilege system. The MySQL documentation warns: “This enables anyone to connect without a password and with all privileges.” It also enables skip_networking, so remote connections are disabled while the option is active. Anyone who can reach the temporary local server can nevertheless perform unrestricted database operations.
1. Isolate the server and stop the normal instance
Prevent other users and applications from accessing the machine while the unauthenticated server is running. Stop MySQL if it is still active, using your deployment’s normal service-management procedure.
Recommended Free Tools
2. Start a temporary server with grant tables skipped
Start MySQL with:
mysqld --skip-grant-tablesPreserve the normal configuration and data-directory options required by your installation. Because exact service commands differ among operating systems, system managers, containers, and vendor-managed packages, substitute the startup mechanism used in your environment while retaining the documented option.
3. Connect locally without a password
Open a local MySQL client session. Do not expect remote access: skip_networking is enabled in this mode.
mysqlIf your installation requires a socket, port, or other local connection option, use the same local connection settings as the temporary server.
4. Re-enable account-management statements
Run:
FLUSH PRIVILEGES;Skipping the grant tables disables account-management statements, including ALTER USER and SET PASSWORD, until privileges are flushed. This is the step most often missed when an otherwise correct reset statement fails.
5. Change the root password
After the flush completes, run:
ALTER USER 'root'@'localhost' IDENTIFIED BY 'MyNewPass';Use the correct host component for the account. Account-management changes are loaded immediately; you do not need to edit grant tables directly.
6. End the unsafe mode
Exit the client, stop the temporary server, and restart MySQL normally. Remove --skip-grant-tables and do not leave skip_networking enabled unless it is deliberately part of your normal configuration. Confirm that the ordinary authenticated service, not the emergency process, is the instance accepting connections.
Best Value
Why mysqladmin password is not the first command here
mysqladmin password does not apply a password change while the server is running with --skip-grant-tables. Flush privileges first, then use an account-management statement such as ALTER USER. Once the server has returned to normal authenticated operation, ordinary administrative tools can be used again according to your installation’s procedure.
Why ALTER USER fails during recovery
You skipped FLUSH PRIVILEGES
In --skip-grant-tables mode, MySQL disables account-management statements. Run FLUSH PRIVILEGES; in the local session, then retry ALTER USER. This limitation applies specifically to the emergency startup mode; it is not a reason to edit grant tables by hand.
The host component is wrong
The statement must target the exact account identity. If the root account is not 'root'@'localhost', substitute its actual host value. A successful change to one root account does not alter another root account with a different host part.
The temporary server is not the instance you think it is
Multiple installations can use different data directories, configuration files, sockets, or service definitions. If the password appears unchanged after a normal restart, confirm that the temporary and normal starts used the same MySQL data directory and configuration.
The initialization file cannot be read
For the preferred method, check the complete path, file permissions, ownership, quoting of paths containing spaces, and the account under which MySQL runs. The service account must be able to read the file, while unrelated users should not. Correct the problem, restart once with the file, and remove it immediately after the statement is processed.
Unix file ownership changed
If mysqld was started as root, it may have created root-owned files in the data directory. Those files can prevent the normal MySQL account from starting the service. Avoid that situation by running the temporary server under the usual MySQL account or by using the installation’s documented user-switching option.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchSecurity checks after the reset
- Delete the initialization file and any copies containing the new password.
- Stop every temporary server process before bringing the normal service online.
- Confirm that the normal startup does not include
--skip-grant-tables. - Confirm that the normal configuration has not unintentionally retained
skip_networking. - Test a local authenticated login with the account and host you changed.
- Review applications or scripts that may still contain the old password and update them only through your normal secret-management process.
- If the emergency mode was exposed to other local users, treat the database as potentially accessed and investigate according to your incident-response policy.
Privilege changes made through account-management statements such as ALTER USER take effect immediately. Direct edits to grant tables are a different operation and require a privilege flush or restart; they are not needed for this reset procedure.
What the documented procedures do not standardize
Oracle documents the reset sequence, but it does not provide one universal stop-and-start command for every systemd service, launchd job, Docker deployment, or vendor-managed MySQL package. Service names, executable paths, sockets, configuration files, and data directories vary. Substitute your environment’s service-management commands while preserving the essential order: stop the normal instance, start one temporary recovery instance, perform the password change, remove the temporary credentials file or unsafe option, and restart normally.
Quick Recap
A compact recovery checklist
- Identify the exact root account, including its host component.
- Prefer a protected initialization file and the
ALTER USERstatement. - Stop the normal MySQL instance before starting a temporary one.
- Use the normal configuration and data directory.
- Delete the initialization file immediately after successful startup.
- If using
--skip-grant-tables, isolate the server, connect locally, runFLUSH PRIVILEGES, then runALTER USER. - Stop the temporary process and restart without
--skip-grant-tablesor unintendedskip_networking. - Test the new password against the normal authenticated instance.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
