MySQL Error 1045

Error number

1045

SQLSTATE

28000

Symbol

ER_ACCESS_DENIED_ERROR

Product

MySQL Server

Versions

MySQL 5.7, 8.0 and 8.4 (in 8.4 also for accounts that use the disabled mysql_native_password plugin)

Category

Access & Privileges

Last reviewed

24 October 2026

What it means

Error 1045 means the server found no account that matches this user name, client host and password (or authentication method), so it refused the login.

A MySQL account is a user name and a host: 'app'@'localhost' and 'app'@'10.0.0.%' are two separate accounts with their own passwords and privileges. When a client connects, the server takes the user name it sent and the host it sees the client coming from, picks the most specific matching row in mysql.user, and checks the credentials with that account's authentication plugin. If no row matches or the check fails, the client gets 1045. The message deliberately looks the same for a wrong password and for a user that does not exist, so it does not reveal which accounts exist.

Read the message closely. The first part is the user name the client sent; the second is the client host as the server sees it, which is not always what you typed (in our runs, connecting to 127.0.0.1 was reported as 'localhost', because the server resolved the address to that name). using password: NO means no password was sent at all, often a missing -p or an empty variable in a configuration file; YES means one was sent, not that it was correct. In PHP the SQLSTATE shows as HY000, because connection errors are reported before a session exists.

Common causes

• The password is wrong or out of date, for example after a password change that not every application or option file picked up.
• No password is sent (using password: NO): the -p option is missing, or the password setting in the application is empty.
• The account exists for a different host: there is 'app'@'localhost' but the client connects over the network, or the account was created for one IP and the client's address changed.
• A more specific account wins the match. The manual's classic case is an anonymous ''@'localhost' account that is chosen instead of 'app'@'%' for local connections, so the password of the anonymous account is checked.
• The client reads other credentials than you expect from an option file such as my.cnf or the [client] section (test with --no-defaults).
• On MySQL 8.4, the account uses mysql_native_password, which is disabled by default there, so its logins fail with 1045.

Diagnose it

Read-only These statements only read metadata (information_schema, performance_schema and SHOW statements) or your own data. They do not change data, privileges or configuration, so they are safe to run first.

SELECT user, host, plugin, account_locked, password_expired, password_last_changed
FROM mysql.user
WHERE user = 'app'
ORDER BY host;

SELECT user, host, plugin
FROM mysql.user
WHERE user = ''
ORDER BY host;

SELECT USER() AS sent_as, CURRENT_USER() AS authenticated_as;
SHOW GRANTS FOR CURRENT_USER();

SELECT error_number, error_name, sum_error_raised, first_seen, last_seen
FROM performance_schema.events_errors_summary_global_by_error
WHERE error_number IN (1045, 3118);

SELECT ip, host, count_authentication_errors, sum_connect_errors, last_error_seen
FROM performance_schema.host_cache
WHERE count_authentication_errors > 0
ORDER BY count_authentication_errors DESC;

SELECT plugin_name, plugin_status
FROM information_schema.plugins
WHERE plugin_name LIKE '%password%';

How to fix it

Each fix is labelled with what it changes. Try read-only checks and the least invasive fix first, and test changes outside production.

-- mysql --no-defaults -h 127.0.0.1 -P 3306 -u app -p

CREATE USER 'app'@'10.0.0.%' IDENTIFIED BY 'a-long-random-password';
GRANT SELECT, INSERT, UPDATE, DELETE ON shop.* TO 'app'@'10.0.0.%';

ALTER USER 'app'@'10.0.0.%' IDENTIFIED BY 'a-new-long-random-password';

ALTER USER 'app'@'10.0.0.%' IDENTIFIED WITH caching_sha2_password BY 'a-long-random-password';

DROP USER ''@'localhost';

Examples

A login that does not exist (a password is sent)

Run with the mysql 8.0.46 client. The host in the message is localhost although the client connected to 127.0.0.1: the server reports the client host by name when it can resolve it.

-- From a command prompt (cws_errlab_nouser is not an account on this server):
-- mysql -h 127.0.0.1 -u cws_errlab_nouser -p
SELECT 1;

ERROR 1045 (28000): Access denied for user 'cws_errlab_nouser'@'localhost' (using password: YES)

No password sent at all

An empty --password= sends no password, so the message says using password: NO. The client also printed mysql: [Warning] Using a password on the command line interface can be insecure.

-- mysql -h 127.0.0.1 -u cws_errlab_nouser --password=
SELECT 1;

ERROR 1045 (28000): Access denied for user 'cws_errlab_nouser'@'localhost' (using password: NO)

MySQL 8.4: an account that still uses mysql_native_password

Shown as documented in the MySQL 8.4 reference manual (Native Pluggable Authentication); not reproduced here, because the lab server is MySQL 8.0 and the lab may not create accounts. The manual adds that the server writes these errors to its error log.

-- On MySQL 8.4 with mysql_native_password disabled (the default):
-- mysql -u userx -p

ERROR 1045 (28000): Access denied for user 'userx'@'localhost' (using password: NO)

How to prevent it

Give each application its own account with an explicit host pattern and only the privileges it needs, keep the password in one secrets store that every instance reads, and rotate it with a plan that updates all consumers together. Remove anonymous accounts, and check for mysql_native_password accounts before upgrading to MySQL 8.4.

Watch failed logins: a sudden rise in 1045 in events_errors_summary_global_by_error or in the host cache after a deployment usually means a stale password, while steady failures from unknown addresses suggest someone guessing passwords. For broader hardening see the SQL security lesson.

Common questions

Learn more on CodeWithSQL

• SQL security
• Install MySQL
• SQL commands: DDL, DML, DCL, TCL and DQL

Official documentation

• Troubleshooting problems connecting to MySQL
• Access control, stage 1: connection verification
• Specifying account names
• Native pluggable authentication (MySQL 8.4)

Last technically reviewed 24 October 2026; examples and diagnostics run on MySQL 8.0.46. Message templates checked against the server's error catalogue (perror) for that version.