Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesiTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
The reliable MySQL 8.4 workflow is two commands: CREATE USER creates an account, and GRANT assigns the privileges it needs. A newly created account has no privileges and its default role is NONE, so creating the login alone does not let it read or change data.
CREATE USER 'app_user'@'localhost' IDENTIFIED BY 'StrongPassword!';
GRANT SELECT, INSERT, UPDATE, DELETE ON shopdb.* TO 'app_user'@'localhost';
SHOW GRANTS FOR 'app_user'@'localhost';Use an explicit host, the narrowest privilege scope, and SHOW GRANTS to verify the result. The examples below use MySQL 8.4 syntax; behavior in MariaDB, MySQL 5.7, and other older releases can differ.
What you are creating
MySQL identifies an account by both a user name and a host. The account 'app_user'@'localhost' is distinct from 'app_user'@'10.0.0.%' and from 'app_user'@'%'. The host part controls where that account may connect from; it is not a comment or an optional label.
CREATE USER adds the account and authentication details but grants nothing. Access begins only after one or more GRANT statements. A grant names a privilege type, an object scope after ON, and the account after TO.
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
Prerequisites and a safe starting plan
- Run the statements while connected as an administrator or another account authorized to create users and grant privileges.
- Know the database and tables the application actually needs.
CREATE USERdoes not create a database. - Choose the connection host deliberately. Use
localhostfor a local-only process, a specific host or controlled range for a remote service, and avoid%unless unrestricted host matching is genuinely required. - Use a strong, unique password and keep it out of source code and shell history where possible.
- Decide whether direct grants are appropriate for one account or whether a role will make a shared permission set easier to maintain.
Plan the account name and host as one value. If an application later connects from a different host than the one in the grant, MySQL will look for a different account and the expected privileges will not apply.
Create the account with CREATE USER
The basic statement is:
CREATE USER 'user_name'@'host_name' IDENTIFIED BY 'password';For a local application named app_user:
CREATE USER 'app_user'@'localhost' IDENTIFIED BY 'StrongPassword!';This creates the login with no object privileges. The account can authenticate, but it cannot select from shopdb, insert rows, or perform administrative work until those capabilities are granted.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Why the host matters
An explicit host is clearer and safer than relying on a default. If the host is omitted in account syntax, MySQL uses %, which matches connections from any host. In practice, write the host explicitly so the intended exposure is visible during review:
| Account form | What it matches | Typical use |
|---|---|---|
'app_user'@'localhost' |
Connections from the database server itself | A local application, job, or maintenance script |
'app_user'@'10.0.0.%' |
Connections whose address matches that network pattern | A service confined to a known private network range |
'app_user'@'%' |
Connections from any host | Only when broad host access is an intentional requirement |
These are separate MySQL accounts even though the user-name portion is identical. Create and grant the exact account that the client will use.
Handling an account that already exists
If the same user-and-host account already exists, a second plain CREATE USER statement fails instead of silently replacing it. Confirm the account you intend to change, then use the appropriate account-management statement rather than creating a subtly different host entry. Do not solve a host mismatch by granting a second, broader account without first checking which account the client is matching.
Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
Grant database permissions
Grant only the operations the application requires. The pattern is:
GRANT privilege_list ON object_level TO 'user_name'@'host_name';For normal application writes in one database:
GRANT SELECT, INSERT, UPDATE, DELETE
ON shopdb.*
TO 'app_user'@'localhost';Here, SELECT, INSERT, UPDATE, and DELETE are the privilege types. shopdb.* means every table in the shopdb database, and the TO account must exactly match the account created earlier.
Choose the narrowest useful scope
Scope in ON |
Coverage | Risk and use |
|---|---|---|
shopdb.* |
All tables in one database | Usually the right boundary for an application dedicated to that database |
shopdb.orders |
One table in one database | Useful when a service must not touch the rest of the schema |
*.* |
All databases and all objects covered by the privilege | Very broad; reserve for accounts with a genuine administrative need |
A database-level grant does not automatically make the account a server administrator. Conversely, a global grant reaches far beyond the application database, so review it carefully before execution.
Granting all privileges at a database scope
When an account truly needs every available privilege on one database, the scope can remain limited while the privilege list uses ALL PRIVILEGES:
GRANT ALL PRIVILEGES
ON shopdb.*
TO 'app_user'@'localhost';This is still broader than a read/write list. Prefer named privileges when you can state the application’s requirements, because the resulting access is easier to audit and less likely to exceed them.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
Add or adjust privileges incrementally
You can issue another grant later without recreating the account. For example, to allow a reporting account to read a database:
GRANT SELECT ON shopdb.* TO 'report_user'@'localhost';To change access, issue a more appropriate grant or revoke the old grant. Keep a record of why each privilege exists; otherwise permissions tend to accumulate as applications evolve.
Use roles for shared permission sets
Direct grants work for a small number of accounts. When several users need the same capabilities, create a role, grant privileges to that role, and grant the role to each user. This gives you one permission set to maintain instead of repeating the same object grants for every account.
CREATE ROLE 'shop_reader';
GRANT SELECT ON shopdb.* TO 'shop_reader';
GRANT 'shop_reader' TO 'alice'@'localhost';
GRANT 'shop_reader' TO 'bob'@'localhost';The role carries the database privilege; Alice and Bob receive it through their role assignment. If the permission set changes, alter the role’s grants rather than editing each user independently.
Default roles and verification
A newly created account starts with default role NONE. Granting a role to a user and making that role the user’s default are separate administrative decisions. If the account should receive the role automatically at login, configure the default role explicitly:
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
SET DEFAULT ROLE 'shop_reader' TO 'alice'@'localhost';Check the account’s effective grant statements after role changes. The exact output shows the direct grants and role-related grants MySQL associates with the account.
Verify permissions with SHOW GRANTS
Do not assume a successful SQL prompt means the intended access was assigned. Run:
SHOW GRANTS FOR 'app_user'@'localhost';MySQL returns the account’s privileges as GRANT statements. Read the output for three details:
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11- The account after
TOhas the expected user and host. - The object after
ONis the intended database, table, or global scope. - The privilege list contains only the operations the account should perform.
For a role-based design, also run SHOW GRANTS FOR on the role itself and on each user. This separates privileges held by the role from privileges assigned directly to an account.
End-to-end examples
Local application with read/write access
- Create the local account:
CREATE USER 'shop_app'@'localhost' IDENTIFIED BY 'Use-a-unique-secret'; - Grant the four required data operations:
GRANT SELECT, INSERT, UPDATE, DELETE ON shopdb.* TO 'shop_app'@'localhost'; - Verify:
SHOW GRANTS FOR 'shop_app'@'localhost';
This design confines both the network origin and the database scope. It does not grant access to other databases.
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
Application on a private network
- Create the account with the network pattern the application actually uses:
CREATE USER 'shop_app'@'10.0.0.%' IDENTIFIED BY 'Use-a-unique-secret'; - Grant database permissions to that same host-qualified account:
GRANT SELECT, INSERT, UPDATE, DELETE ON shopdb.* TO 'shop_app'@'10.0.0.%'; - Verify the exact account:
SHOW GRANTS FOR 'shop_app'@'10.0.0.%';
If the client connects from outside the stated range, this account will not be the matching identity. Reassess the network boundary instead of immediately changing it to %.
Read-only reporting account
- Create the account:
CREATE USER 'report_user'@'localhost' IDENTIFIED BY 'Another-unique-secret'; - Grant only read access:
GRANT SELECT ON shopdb.* TO 'report_user'@'localhost'; - Confirm that
SHOW GRANTS FOR 'report_user'@'localhost';does not show write privileges.
Shared role for analysts
- Create a role:
CREATE ROLE 'analyst_read'; - Grant the role read access:
GRANT SELECT ON shopdb.* TO 'analyst_read'; - Assign it to each account:
GRANT 'analyst_read' TO 'alice'@'localhost'; - Set a default role when automatic role use is required:
SET DEFAULT ROLE 'analyst_read' TO 'alice'@'localhost'; - Use
SHOW GRANTSfor the role and user to verify both layers.
Common mistakes and fixes
The user can log in but receives an access-denied error
Authentication and authorization are separate. A successful CREATE USER does not grant data access. Run SHOW GRANTS FOR with the exact user and host, then add the required privilege at the correct scope.
Free tools Windows power users keep installed
One-click scans. No signup required.
The grant appears correct, but the application still has no access
Check the host portion first. An account created for localhost is not the same as one created for 10.0.0.%. The application may also be using a different user name, database, or connection origin than expected. Verify the connection configuration and inspect grants for that exact account.
A grant was made on the wrong database
Database names in the ON clause are part of the permission boundary. A grant on shopdb.* does not cover a similarly named database. Correct the grant at the intended scope and remove the unintended grant according to your change-control process.
An administrator used *.* for convenience
A global grant is difficult to contain because it covers every database and object reached by that privilege. Replace it with a database-level or table-level grant when the application does not need global access. Keep global privileges for accounts whose administrative duties justify them.
Role privileges are not taking effect
Confirm three separate facts: the privilege was granted to the role, the role was granted to the user, and the role is active for the user’s sessions. Because new accounts have default role NONE, configure a default role when that is the intended behavior, then verify with SHOW GRANTS.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →The account was created with a broader host than intended
Do not rely on memory about which account a client matches. Review the host-qualified account names and their grants. Narrow future access to an explicit host or controlled range, and remove obsolete broad accounts only after confirming that no required service depends on them.
Security and maintenance checklist
- Write the complete
'user'@'host'identity in everyCREATE USER,GRANT, andSHOW GRANTScommand. - Prefer
localhost, a specific host, or a limited network range over%. - Prefer
database.*or a table-level object over*.*for application accounts. - List individual privileges such as
SELECT,INSERT,UPDATE, andDELETEwhen that is sufficient. - Use roles when multiple users share the same permission set.
- Remember that
CREATE USERstarts with no privileges and default roleNONE. - Run
SHOW GRANTSafter creation, after every permission change, and during troubleshooting. - Keep credentials unique and protect them from application logs, repositories, and command-history exposure.
Command reference
| Goal | Statement |
|---|---|
| Create a local account | CREATE USER 'app_user'@'localhost' IDENTIFIED BY 'StrongPassword!'; |
| Grant selected database privileges | GRANT SELECT, INSERT, UPDATE, DELETE ON shopdb.* TO 'app_user'@'localhost'; |
| Grant all available privileges at database scope | GRANT ALL PRIVILEGES ON shopdb.* TO 'app_user'@'localhost'; |
| Inspect an account | SHOW GRANTS FOR 'app_user'@'localhost'; |
| Create a shared role | CREATE ROLE 'shop_reader'; |
| Grant a role database access | GRANT SELECT ON shopdb.* TO 'shop_reader'; |
| Assign a role to a user | GRANT 'shop_reader' TO 'alice'@'localhost'; |
MySQL 8.4 scope and version note
The syntax and account behavior described here are for MySQL 8.4. In particular, the account starts without privileges, an omitted host defaults to %, and roles can hold shared grants. MariaDB, MySQL 5.7, and other versions were not evaluated here, so check the manual for the exact release before applying these statements to a different server.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
