MongoDB Error 18

Error code

18

Code name

AuthenticationFailed

Product

MongoDB

Versions

MongoDB 7.0 and 8.0 (wording checked against the 8.0 source)

Category

Authentication & Authorisation

Last reviewed

24 October 2026

What it means

Error 18 (AuthenticationFailed) means the login was rejected: the user name, password, authentication database or mechanism did not match a user on the server.

When a client logs in with SCRAM (MongoDB's default mechanism), it proves it knows the password for a user stored in one specific database, the authentication database. If anything does not match, MongoDB 8.0 replaces the detailed reason with one fixed reply, Authentication failed., for every SASL failure apart from protocol and mechanism errors, so the client is not told whether the user exists. The real reason (for example an unknown user, or a SCRAM key mismatch for a wrong password) is written only to the server log, in the "Failed to authenticate" entry with the user, database, mechanism and error.

The most common cause is not the password itself but where the client looks for the user. The connection string option authSource names the authentication database; it defaults to the database in the URI path if there is one, otherwise admin. A user created in admin and a URI ending in /shop without authSource=admin therefore fails. The second classic cause is a password containing characters such as @ : / ? # [ ] $ that were not percent-encoded in the URI.

Common causes

• Wrong authentication database: the URI path names an application database, the user was created in admin, and authSource is missing.
• Special characters in the user name or password are not percent-encoded in the connection string, so the driver sends a different password.
• Wrong or old password, for example after a rotation that did not reach every application instance or secret store.
• The user does not exist on this deployment (a different cluster, environment or Atlas project) or was dropped.
• The client asks for a mechanism the user's credentials do not support (for example SCRAM-SHA-256 for a user created with SCRAM-SHA-1 only).

Diagnose it

Read-only These mongosh commands only read data, indexes, statistics and server state (find, aggregate without $out or $merge, getIndexes, stats, currentOp, rs.status). They do not change data, users or settings, so they are safe to run first.

db.adminCommand({ getLog: "global" }).log
  .filter(line => line.includes("Failed to authenticate"))
  .slice(-5)
  .forEach(line => print(line))

db.getSiblingDB("admin").runCommand({
  usersInfo: { forAllDBs: true },
  filter: { user: "appUser" }
})

db.runCommand({ hello: 1, saslSupportedMechs: "admin.appUser" }).saslSupportedMechs

encodeURIComponent("#MyP@ssword?")    // "%23MyP%40ssword%3F"

How to fix it

Each fix is labelled with what it changes. Try read-only checks and the least invasive fix first, and test changes outside production.

mongodb://appUser:S3cret%40pass@db1.example.net:27017/shop?authSource=admin

const uri = `mongodb://${encodeURIComponent(user)}:${encodeURIComponent(pass)}@db1.example.net:27017/?authSource=admin`

db.getSiblingDB("admin").changeUserPassword("appUser", passwordPrompt())

mongodb://appUser:...@db1.example.net:27017/?authSource=admin&authMechanism=SCRAM-SHA-256

Examples

The user is in admin but the URI points at shop

Not reproduced here: no MongoDB server is installed for this site. The reply text is the fixed authenticationFailedStatus in MongoDB 8.0's source (authorization_manager.cpp), which the SASL commands return for every failure apart from protocol and mechanism errors. The connection string rules (authSource defaults to the path database) are from MongoDB's connection string options documentation.

// user created with db.getSiblingDB("admin").createUser({ user: "appUser", ... })
mongosh "mongodb://appUser:S3cret%40pass@db1.example.net:27017/shop"

MongoServerError: Authentication failed.

An unencoded @ in the password

Not reproduced here: no MongoDB server is installed for this site. MongoDB's documentation requires the characters $ : / ? # [ ] @ to be percent-encoded in credentials. Depending on the client, an unencoded @ makes the URI fail to parse or sends the wrong password; the result shows the second case and is illustrative.

// password is S3cret@pass
mongosh "mongodb://appUser:S3cret@pass@db1.example.net:27017/?authSource=admin"

MongoServerError: Authentication failed.

How to prevent it

Always write authSource explicitly in connection strings, keep credentials out of the URI where the driver allows separate options, and generate URIs with an encoding function rather than string concatenation.

Rotate passwords with an overlap plan (update every consumer, then retire the old secret) and monitor the "Failed to authenticate" log entries: a burst usually means one instance still has an old secret.

Common questions

Official documentation

• MongoDB error codes (18 AuthenticationFailed)
• Connection string options (authSource, percent-encoding)
• Node.js driver connection troubleshooting (authentication error)
• SCRAM authentication

Last technically reviewed 24 October 2026; examples and diagnostics run on MongoDB 8.0 documentation and source (error_codes.yml r8.0.0); not run locally. Codes and code names are checked against MongoDB's error_codes.yml (8.0); no MongoDB server was available, so the examples were not run locally.