What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
MySQL has no universal default password. The initial password depends on how the server’s data directory was initialized and, in some installations, on the installer’s behavior. A normal mysqld --initialize run creates root@localhost with a randomly generated, already-expired temporary password recorded in the server error log. mysqld --initialize-insecure creates the initial root account without a password. Either way, set a strong permanent password immediately with ALTER USER.
There is no single MySQL default password
Values such as root, mysql, or a blank password are not universal MySQL defaults. They describe only one possible initial state. The decisive factor is how the MySQL data directory was initialized, together with any installer-specific setup.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →
MySQL identifies an account by both its user name and its host. Therefore, root@localhost, root@127.0.0.1, and root@::1 can be different accounts with different passwords and privileges. A successful login to one does not prove that another account exists or uses the same credential.
How initialization sets the first root credential
| Initialization state | Initial root credential | What to do next |
|---|---|---|
mysqld --initialize |
A random temporary password for root@localhost; it is written to the server error log and expires immediately. |
Find the password in the error log, log in with mysql -u root -p, then replace it with ALTER USER. |
mysqld --initialize-insecure |
No password for the initial root account. | Connect with mysql -u root --skip-password, then assign a strong password before other administration. |
| Installer-defined setup | Depends on the installer and selected options; there is no guaranteed password value. | Check the installer’s recorded credentials or determine whether the server was initialized securely or insecurely. |
Why the random password is not a normal long-term password
The password generated by --initialize is deliberately temporary and expired. It is intended to let the administrator perform the first authenticated login, not to remain in use. Until it is changed, ordinary administrative work will be blocked by the expired-password state.
#1 Best Overall
Why an insecure initialization still needs an immediate password
--initialize-insecure is useful when an administrator wants to choose the first password interactively, but it leaves the initial root account without password protection. Treat that state as a short setup window only. Set a password before creating users, importing data, or exposing the server to other local users.
Reset the password when the temporary password is available
Use this path when the server was initialized with mysqld --initialize and you can read the generated credential in the error log.
- Locate the server error log. The initialization process writes the temporary root password there. The exact file location depends on the server configuration and operating system.
- Start the MySQL client and request a prompt:
mysql -u root -pWhen prompted, enter the temporary password exactly as it appears in the log. Do not append the password to the command.
- Replace the expired password:
ALTER USER 'root'@'localhost' IDENTIFIED BY 'new_password';Use a long, unique password that is not used for another service.
- Reconnect normally. Exit the client and test a fresh login with
mysql -u root -p. A new session confirms that the permanent credential is being accepted.
If the temporary password was not copied during initialization, the error log is the authoritative place to recover it. Searching shell history or guessing common values is not a substitute: there is no fixed MySQL password to guess.
Rank #2
Set a password after an insecure initialization
If the data directory was created with mysqld --initialize-insecure, connect without supplying a password:
mysql -u root --skip-passwordAfter the client connects, assign the password immediately:
ALTER USER 'root'@'localhost' IDENTIFIED BY 'new_password';Exit and verify the change with:
mysql -u root -pThe --skip-password option is appropriate only for this initial no-password state. It is not a recovery mechanism for a password that has been forgotten, and leaving the account passwordless creates an avoidable local security risk.
Reset a forgotten root password with grant-table bypass
When the current password is unknown, MySQL’s generic recovery procedure is to start the server temporarily with --skip-grant-tables. This bypasses normal authentication so the administrator can change the credential. It is a maintenance operation that requires control of the machine and the ability to stop and start the server.
Recovery sequence
- Stop the MySQL server. Use the service or startup method appropriate to the operating system. Do not attempt to launch a second recovery instance against the same data directory while the normal server is still running.
- Start it temporarily with
--skip-grant-tables. Follow the platform-specific MySQL startup instructions and keep this mode active only for the reset. - Connect without a password:
mysql - Reload the grant tables:
FLUSH PRIVILEGES; - Set the new credential:
ALTER USER 'root'@'localhost' IDENTIFIED BY 'MyNewPass';Use the actual account host that should be reset if it is not
localhost. - Stop the recovery instance.
- Start MySQL normally. Remove
--skip-grant-tablesand any temporaryskip_networkingoverride before allowing normal clients to connect. - Test an authenticated login:
mysql -u root -p
Understand the security exposure before using this method
MySQL’s documentation warns: “This enables anyone to connect without a password and with all privileges.” Anyone who can reach that recovery instance can therefore act with full database privileges. Plan the reset during a controlled maintenance window, restrict local access to the machine, and shut the bypass instance down as soon as the password is changed.
The bypass also enables skip_networking, which disables remote connections while recovery is in progress. That behavior limits network exposure but means a remote administration session will not work; perform the reset from the server itself or another permitted local path. When normal startup resumes, verify that you have not left a configuration override that unintentionally prevents required network connections.
Why FLUSH PRIVILEGES comes first
With grant-table checking disabled, issue FLUSH PRIVILEGES before changing the account. This reloads the privilege information so the account-management statement can be processed under the normal privilege data. Then run ALTER USER, shut down the bypass instance, and restart without the recovery option.
Free tools Windows power users keep installed
One-click scans. No signup required.
Choose the correct reset path
| Your situation | Initial state or condition | Connection command | Password-change action | Security considerations |
|---|---|---|---|---|
| The generated password is available | Initialized with --initialize |
mysql -u root -p |
Run ALTER USER 'root'@'localhost' IDENTIFIED BY 'new_password'; |
Normal authentication remains enabled; the temporary password is expired and should be replaced immediately. |
| The account has no password | Initialized with --initialize-insecure |
mysql -u root --skip-password |
Run the same ALTER USER statement, then reconnect with -p. |
Use only during initial setup; do not leave root passwordless. |
| The password is forgotten | Normal authentication blocks access | Start with --skip-grant-tables, then use mysql |
Run FLUSH PRIVILEGES, then ALTER USER; restart normally afterward. |
All privileges are available without a password during the bypass; remote connections are disabled through skip_networking. |
Fix “Access denied for user root” by checking the host part
An error naming root does not necessarily mean the password is wrong. MySQL matches the complete account name, including the host. A client connecting through a socket may match root@localhost, while a TCP connection to 127.0.0.1 may require root@127.0.0.1. IPv6 loopback uses root@::1.
Match the account to the connection method
- Connect through the same local method that was used when the account was created, or reset the account whose host matches the intended connection.
- If
skip_name_resolveis enabled, MySQL does not resolve host names for account matching. A connection from127.0.0.1or::1may therefore fail to matchroot@localhost. - Create or administer an account for the numeric address when that is the connection path, following your organization’s least-privilege policy rather than granting unnecessary remote access.
Changing a password on root@localhost does not change the password for similarly named accounts at other hosts. Identify the exact host part before deciding that a reset failed.
Best Value
Enter passwords safely from the MySQL client
Use -p without an inline value:
mysql -u root -pThe client then prompts for the password without placing it in the command text. Supplying a password directly, such as -pSecretValue, can expose it through process inspection and is discouraged in MySQL account documentation. Avoid copying credentials into shell history, scripts, or shared process listings.
Optional tools for initial hardening and account administration
mysql_secure_installation
MySQL documents mysql_secure_installation as a utility that automates much of the initial hardening workflow. It can be useful after the first successful login, but it does not create a universal default password and it is not required for the forgotten-password recovery procedure.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteMySQL Workbench
MySQL Workbench provides a graphical account-management route. It is an optional administration interface; the server and client commands above remain the direct method for setting or recovering the root credential.
Quick Recap
Troubleshooting checklist
- You cannot find a default password: stop guessing common values. Determine whether the data directory used
--initialize,--initialize-insecure, or installer-specific setup. - The temporary password is rejected: copy it from the correct server error log, include the exact characters, and ensure you are connecting to the same server instance that produced the log.
- The client says the password is expired: complete the first-login
ALTER USERoperation instead of repeatedly retrying the temporary credential. - Passwordless login fails:
--skip-passwordis intended for an account initialized without a password. It will not bypass an existing credential. ALTER USERappears to affect the wrong account: check whether the connection is usinglocalhost,127.0.0.1, or::1, especially whenskip_name_resolveis enabled.- Remote access stops during recovery: this is expected when
skip_networkingis enabled with grant-table bypass. Complete the reset locally and restart without the bypass settings. - Access remains open after the reset: confirm that the temporary server has stopped and that normal startup no longer includes
--skip-grant-tables.
Recommended first-login checklist
- Identify how the data directory was initialized.
- If initialization was secure, retrieve the random temporary password from the error log.
- Log in with
mysql -u root -p, or usemysql -u root --skip-passwordonly for an insecure initialization. - Run
ALTER USER 'root'@'localhost' IDENTIFIED BY 'new_password';with a strong, unique password. - Reconnect using a password prompt and confirm that the intended account host matches your connection method.
- Remove any recovery startup options and consider the documented hardening utility or graphical account manager for additional administration.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
