Error 1045 means MySQL rejected the login. The fix depends on which part failed — the password, the host the user is allowed from, or missing privileges. Here's how to find and fix it, plus the auth-plugin and case-sensitivity gotchas.
Quick answer
MySQL error 1045 means the login was rejected. Check the three parts in the message: the password, the host the user is allowed to connect from ('user'@'localhost' is not the same as 'user'@'%'), and the user's privileges. Reset the password with ALTER USER and grant the database with GRANT, then retry.
Read the error carefully
The message tells you a lot: Access denied for user 'app'@'localhost' (using password: YES) means the user, the host (localhost) and that a password was sent. using password: NO means no password was provided at all.
The exact wording narrows it down fast — match yours here, then go to the fix:
| The error shows… | Likely cause | Fix |
|---|---|---|
| (using password: YES) | Wrong password for that user | Reset the password (Cause 1) |
| (using password: NO) | App sent no password at all | Set the password in the app config |
| user@'localhost' but you connect remotely | User not allowed from that host | Grant the user for the right host (Cause 2) |
| Login works but queries are denied | Missing privileges on the database | GRANT the needed privileges (Cause 3) |
| Worked before an upgrade | Auth-plugin mismatch | Align the user's auth plugin (below) |
Cause 1: wrong password
The most common cause. Reset it (as root) and update your app config to match:
ALTER USER 'app'@'localhost' IDENTIFIED BY 'new_password';
FLUSH PRIVILEGES;Cause 2: wrong host
A user defined as app@localhost can't connect from another IP. If your app connects over the network, create/grant the user for that host:
CREATE USER 'app'@'%' IDENTIFIED BY 'password';
GRANT ALL PRIVILEGES ON mydb.* TO 'app'@'%';
FLUSH PRIVILEGES;MySQL treats them differently: localhost uses a Unix socket, 127.0.0.1 uses TCP. A user granted on one may be denied on the other. Match how your app actually connects.
Cause 3: missing privileges
The user exists and the password is right, but it has no rights on the database. Grant them as shown above, scoped to the specific database.
Verify the user
SELECT user, host FROM mysql.user WHERE user = 'app';
SHOW GRANTS FOR 'app'@'localhost';1045 is always user + password + host. Confirm the password, confirm which host the user is allowed from, and confirm the grants.
Cause 4: wrong authentication plugin
MySQL 8 defaults new users to caching_sha2_password, which some older clients/drivers can't speak, producing what looks like a plain access-denied. If your app can't support the new plugin, switch the user to the legacy mysql_native_password plugin with an ALTER USER ... IDENTIFIED WITH mysql_native_password BY 'password' statement, then FLUSH PRIVILEGES.
Cause 5: leftover skip-grant-tables or case sensitivity
If the server was ever started with --skip-grant-tables for a manual fix and not restarted cleanly afterward, grants can end up inconsistent. Also remember usernames are case-sensitive on most systems — App and app are different users.
How to prevent 1045 errors
- Store credentials in environment variables/config, not hardcoded — makes rotating a leaked password fast.
- Grant the narrowest host you actually need (a specific IP) rather than
%where possible. - After any migration or restore, re-check that users and grants moved with the data — a dump can miss the mysql.user table.
Related errors
If the database service itself won't start, see fixing MySQL/MariaDB won't start. WordPress sites showing a database error from the same root cause are covered in fixing "Error establishing a database connection". phpMyAdmin login issues are covered in fixing phpMyAdmin access denied.
MySQL is a trademark of Oracle Corporation. MariaDB is a trademark of MariaDB Foundation. ESAGAMES is an independent hosting provider, not affiliated with or endorsed by Oracle.