MySQL Default Username and Password

The server is running, the application cannot log in, and nobody remembers what the installer asked for. The administrative account is root, and there is no default password to try: MySQL either generated a random one and wrote it somewhere, or the person who installed it chose one. Which of the two happened is decided by how the data directory was initialized.

The MySQL 8.4 manual says installation "creates only a 'root'@'localhost' superuser account that has all privileges and can do anything". Where that account's password came from depends on the installation method:

• mysqld --initialize generates a random password, marks it expired, and writes it to the server error log.
• mysqld --initialize-insecure leaves the account without a password, so you connect with mysql -u root --skip-password and set one straight away.
• The macOS installer generates a random password and displays it in a dialog box, and RPM packages write theirs to the server error log.
• Debian packages and the Windows MSI installer with MySQL Configurator offer to assign the password during setup.
• A Docker container takes it from its own environment, usually the MYSQL_ROOT_PASSWORD variable, so the value sits in the container configuration.

The error log is where three of those five put the answer, so read it before resetting anything. It is a file on disk unless the server was started on Windows with --console, which the manual says makes the console the default destination instead. The commands below are the MySQL 8.4 ones, and they are what a 5.7 server needs too: the 5.7 pages on dev.mysql.com now redirect to the current reference manual.

How to check the current root account

Once you can log in, look at the account before you change it. SHOW CREATE USER prints the statement that would recreate it:

SHOW CREATE USER 'root'@'localhost';

The output names the authentication plugin in an IDENTIFIED WITH clause and ends with the password expiry, history, and reuse policy attached to the account. Running it for an account other than your own needs the SELECT privilege on the mysql system schema, and without the SELECT privilege on mysql.user the password hash prints as <secret> rather than as the hash.

To see every root entry and the host each one accepts, read the grant table:

SELECT user, host, plugin
FROM mysql.user
WHERE user = 'root';

A MySQL 8.4 server installed with its defaults answers with a single row, because caching_sha2_password is the default authentication plugin in 8.4:

The localhost in that row answers the other half of the question people arrive with. MySQL accepts a connection only when the Host and User columns of some row in the grant table match where the connection came from and the name it gave, so an account written for localhost refuses a connection from another machine even when the password is right.

Design and visualize
your database schema

Edit referenced records
in related tables

Query your data
visually too

Reuse the SQL
generated

Free Download

Reset the MySQL root password on Windows

The init file method sets the new password while the server starts, so the server never runs with its privilege checks switched off. Stop the MySQL service first, from the Services manager or the Task Manager.

Put the statement that changes the password in a file, C:\mysql-init.txt:

ALTER USER 'root'@'localhost' IDENTIFIED BY 'MyNewPass';

Then start the server yourself from the MySQL bin directory and hand it the file. The manual writes both Windows paths with doubled backslashes:

cd "C:\Program Files\MySQL\MySQL Server 8.4\bin"
mysqld --defaults-file="C:\\ProgramData\\MySQL\\MySQL Server 8.4\\my.ini" --init-file=C:\\mysql-init.txt

The server reads the file, runs the ALTER USER, and finishes starting up. Stop it, delete C:\mysql-init.txt, and start the MySQL service the normal way. Do not leave that file behind: it holds the new root password in plain text.

The manual also shows the short form, mysqld --init-file=C:\\mysql-init.txt, without the --defaults-file. Which of the two you need depends on how MySQL was installed: the manual says you may have to specify a --defaults-file option if you installed MySQL using the MySQL Installation Wizard. If MySQL is not installed in the default location, adjust the bin directory and the my.ini path to match.

Reset the MySQL root password on Linux or macOS

The same init file method works here, run as the Unix user the server runs as, usually mysql. Stop the server with the process id it wrote next to its data directory, write the ALTER USER statement to a file the mysql user can read, and start the server with it:

kill `cat /mysql-data-directory/host_name.pid`
mysqld --init-file=/home/me/mysql-init &

Delete /home/me/mysql-init once the server is up, then restart it normally.

When the init file is not an option, the fallback is to start the server with --skip-grant-tables. Do not do this on a machine other people can reach. While that option is in effect, anyone who connects gets in without a password and with every privilege. MySQL 8.4 also turns on skip_networking alongside it, which refuses remote connections and is the only thing keeping the running server to itself.

mysqld --skip-grant-tables &

mysql

--skip-grant-tables also disables ALTER USER, so reload the grant tables inside the session before you use it:

FLUSH PRIVILEGES;
ALTER USER 'root'@'localhost' IDENTIFIED BY 'MyNewPass';

Stop that server and start MySQL normally as soon as the password is changed. ALTER USER is the statement for the password itself on MySQL 8.0 and 8.4; the SET PASSWORD examples that still circulate belong to much older releases.

Secure MySQL after regaining access

A recovered root password is a working server, not a safe one. Give each application its own MySQL user rather than the root account, and grant that user privileges on the one database it reads and writes instead of on *.*. The host half of the account name is the cheapest restriction available: 'app_user'@'localhost' or 'app_user'@'10.0.%' costs nothing to write and refuses connections from everywhere else, while 'app_user'@'%' accepts them from any machine that can reach the port.

Write down what the server now holds while the outage is fresh. Which databases exist, which accounts can reach them, and which tables the application actually uses are the questions the next incident starts with, and interactive schema documentation or a MySQL ER diagram answers them faster than a second round of SHOW statements. It also tells you whether the server you just reset is the one you meant to reset.

Use DbSchema with a safer MySQL account

Give DbSchema its own MySQL account instead of the root password. Create a user with SELECT on the databases you want to look at, click Connect to Database, pick MySql, and DbSchema downloads the JDBC driver and opens the Connection Dialog for it. Enter the Server Host and Port, the Database User and Password of the new account, and tick Remember to keep the password on your computer.

Two fields on that dialog are worth setting for a server you have just recovered. Read Only Connection, on the Settings tab, makes DbSchema open the connection in read-only mode, so the database refuses every change made through it. Highlight, on the same tab, colors the connection as Production, Development, or Test, which is what stops the next reset from landing on the wrong server.

Click Connect and DbSchema reverse-engineers the schema into a diagram. That diagram and everything DbSchema reads from the database live in a .dbs model file on your computer, so rearranging it changes nothing on the server; the connection is what touches MySQL, and Read Only Connection keeps even that one-way.

Download DbSchema at https://dbschema.com/download.html, point the Connection Dialog at the server with the account you just created, and connect. Connecting, reverse-engineering, and the diagrams are in the free Community Edition; saving the model to a file and exporting HTML5 documentation are in Pro.

FAQ

What is the default username and password for MySQL?

The username is root. There is no default password to try, and the opening section lists what each installation method does with the password it created instead.

Where do I find the temporary MySQL root password?

The server error log holds it, and the RPM installation page names the file: /var/log/mysqld.log on RHEL, Oracle Linux, CentOS, and Fedora, and /var/log/mysql/mysqld.log on SLES. The manual reads the line out of it with sudo grep 'temporary password' /var/log/mysqld.log.

Do I need FLUSH PRIVILEGES after ALTER USER?

No, because ALTER USER reloads the grant tables itself, as GRANT, REVOKE, SET PASSWORD, and RENAME USER do. FLUSH PRIVILEGES is for grant tables you changed with INSERT, UPDATE, or DELETE, and for a session started with --skip-grant-tables.

Is the default MySQL password blank?

Only on a data directory initialized with mysqld --initialize-insecure, which creates root with no password at all. The manual calls that installation unprotected, since anyone can then connect as root and be granted all privileges.

Should I connect DbSchema as root?

Create a separate account for it, with SELECT on the databases you want to look at and nothing on *.*. The section above names the two settings on the DbSchema Connection Dialog worth pairing with that account.