How to Change MySQL User Password

Rotating a database password is one of those small tasks you do often: after onboarding a developer, before handing over a server, or right after you suspect credentials have leaked. On MySQL and MariaDB, this is a single SQL statement, but the correct syntax changed between major versions and the older guides on the web still show commands that no longer work.

This guide shows you how to change a MySQL or MariaDB user password from the mysql shell, with the modern syntax that works on MySQL 5.7.6+, MySQL 8.0 and 8.4, and MariaDB 10.2+.

Check your database version #

The password-change command depends on which server you are running. First, you can check the installed client version with:

mysql --version

Typical MySQL output:

mysql  Ver 8.4.11-0ubuntu0.26.04.1 for Linux on x86_64 ((Ubuntu))

Typical MariaDB output:

mysql from 11.8.6-MariaDB, client 15.2 for debian-linux-gnu (x86_64) using  EditLine wrapper

On MariaDB, the client is also available as mariadb. The client version can differ from the server version, especially when connecting to a remote database. Check the connected server version after logging in, as shown below.

For a list of existing accounts before you change anything, see how to show MySQL users .

How to Change MySQL User Password #

Follow the steps below to change the password of a MySQL or MariaDB user account.

1. Log in to the MySQL shell as root #

Open the MySQL shell as the root user and enter your password when prompted:

mysql -u root -p

If you have not set a password for the MySQL root account, or your installation uses the auth_socket plugin (the default on recent Ubuntu packages), log in with:

sudo mysql

Once connected, check the server version before choosing the password-change syntax:

SELECT VERSION();

The result identifies the server version. MariaDB includes MariaDB in the version string.

2. Change the user password #

On MySQL 5.7.6 and later, MySQL 8.0 and 8.4, and MariaDB 10.2 and later, use ALTER USER:

ALTER USER 'user-name'@'localhost' IDENTIFIED BY 'NEW_USER_PASSWORD';

Replace user-name with the account you want to update and NEW_USER_PASSWORD with the new password. If the user connects from a remote host, replace localhost with the matching host or IP address defined on the account.

You can also use SET PASSWORD. On MySQL, pass the new password as a plain string:

SET PASSWORD FOR 'user-name'@'localhost' = 'NEW_USER_PASSWORD';

MariaDB expects a password hash in SET PASSWORD. Wrap the new password in the PASSWORD() function:

SET PASSWORD FOR 'user-name'@'localhost' = PASSWORD('NEW_USER_PASSWORD');

On MySQL 8.0 and later, the PASSWORD() function no longer exists, and using it raises a syntax error. On MariaDB, a plain string fails with ERROR 1372. If you are not sure which server you are running, use ALTER USER. It works the same way on both.

If the change succeeds, the server returns:

Query OK, 0 rows affected (0.00 sec)

You do not need to run FLUSH PRIVILEGES after ALTER USER or SET PASSWORD. It is needed after direct changes to the grant tables and before using account-management statements during recovery with --skip-grant-tables.

Log out of the MySQL shell:

quit;

3. Verify the new password #

Connect with the user account you just updated:

mysql -u user-name -h localhost -p

Enter the new password at the prompt. If the credentials are correct, the MySQL shell opens; otherwise you get ERROR 1045 (Access denied) and need to repeat step 2.

Change the MySQL root password #

On Ubuntu and Debian, the database root account does not log in with a password by default. MySQL uses the auth_socket plugin, and MariaDB uses unix_socket. Both let the system root user open the shell with sudo mysql without a password. To set a root password, you also need to change how root logs in.

MySQL 8.0 and later #

Log in with sudo mysql and switch root to password authentication:

ALTER USER 'root'@'localhost' IDENTIFIED WITH caching_sha2_password BY 'NEW_ROOT_PASSWORD';

The IDENTIFIED WITH caching_sha2_password part is required. A plain ALTER USER ... IDENTIFIED BY returns Query OK, but the account stays on auth_socket and the new password is never used.

Once root has a password, sudo mysql stops working. From now on, log in with:

mysql -u root -p

If root already uses password authentication, the ALTER USER statement from step 2 is enough. On MySQL 8.0 and later, use caching_sha2_password when switching root from socket to password authentication. MySQL 8.4 disables mysql_native_password by default, so selecting that plugin fails with ERROR 1524.

On MySQL 5.7, the server does not support caching_sha2_password. To switch a socket-authenticated root account to password authentication on that version, use IDENTIFIED WITH mysql_native_password BY 'NEW_ROOT_PASSWORD' instead.

MariaDB #

On MariaDB 10.4 and later, root can log in either through the Unix socket or with a password. To keep both methods and set the password in one statement, run:

ALTER USER 'root'@'localhost' IDENTIFIED VIA unix_socket OR mysql_native_password USING PASSWORD('NEW_ROOT_PASSWORD');

After this, sudo mysql still works, and mysql -u root -p accepts the new password.

A plain ALTER USER 'root'@'localhost' IDENTIFIED BY '...' also sets the password, but it removes unix_socket from the account. sudo mysql then fails with ERROR 1045.

Troubleshooting #

ERROR 1064 (42000): You have an error in your SQL syntax
You are most likely running MySQL 8.0 or later and passing the old PASSWORD('...') wrapper. Remove the wrapper and pass the password as a plain quoted string: ALTER USER 'user'@'localhost' IDENTIFIED BY 'secret';. On MariaDB, the MySQL syntax IDENTIFIED WITH caching_sha2_password BY '...' also produces a syntax error: MariaDB uses USING or AS for plugin authentication strings, not BY. Recent MariaDB versions include a caching_sha2_password plugin for migrations, but it is not installed by default. For root, use the MariaDB statement above.

ERROR 1372 (HY000): Password hash should be a 41-digit hexadecimal number
You ran SET PASSWORD with a plain string on MariaDB. MariaDB expects a hash here. Wrap the password in PASSWORD('...'), or use ALTER USER ... IDENTIFIED BY instead.

ERROR 1524 (HY000): Plugin ‘mysql_native_password’ is not loaded
MySQL 8.4 disables the mysql_native_password plugin by default. Use IDENTIFIED WITH caching_sha2_password instead. It has been the default authentication plugin since MySQL 8.0.

ERROR 1819 (HY000): Your password does not satisfy the current policy requirements
The validate_password component is active, and the new password is too weak. mysql_secure_installation offers to enable it during setup. Check the current rules with SHOW VARIABLES LIKE 'validate_password%'; and choose a longer password with upper and lower case letters, digits, and special characters.

ERROR 1698 (28000): Access denied for user ‘root’@’localhost’
The root account is still using auth_socket. This happens when you set the root password on MySQL with a plain ALTER USER ... IDENTIFIED BY. Log in with sudo mysql and use the root password statement above for your MySQL version.

ERROR 1045 (28000): Access denied for user
Either the password you typed is wrong, or the account uses a different host. List the accounts with SELECT user, host FROM mysql.user; and confirm that you are updating the exact 'user'@'host' pair the client is trying to authenticate with.

ERROR 1396 (HY000): Operation ALTER USER failed for ‘user’@’localhost’
The account does not exist with that exact host. Double-check the host part (for example 'user'@'%' is a different account from 'user'@'localhost'). Create the account with CREATE USER or update it using the correct host.

Password change has no effect for remote clients
The user connects from a different host than the one you updated. MySQL treats 'user'@'localhost' and 'user'@'10.0.0.5' as separate accounts, each with its own password. Update each host entry you care about.

FAQ #

How do I change the MySQL root password?
On Ubuntu with MySQL 8.0 or later, log in with sudo mysql and run ALTER USER 'root'@'localhost' IDENTIFIED WITH caching_sha2_password BY 'new_password';. MySQL 5.7 requires mysql_native_password instead. On MariaDB 10.4 and later, use IDENTIFIED VIA unix_socket OR mysql_native_password USING PASSWORD('new_password') to keep sudo mysql working.

Do I need to run FLUSH PRIVILEGES after ALTER USER?
No. Account-management statements such as ALTER USER, SET PASSWORD, CREATE USER, DROP USER, and GRANT take effect without it. You need FLUSH PRIVILEGES after modifying the grant tables directly, or before ALTER USER when recovering access with --skip-grant-tables.

How do I reset a forgotten MySQL root password?
Recovery with --skip-grant-tables requires running FLUSH PRIVILEGES; before ALTER USER, then restarting the server normally. Follow the full procedure, including the systemd steps, in our guide on how to reset the MySQL root password .

Why does SET PASSWORD with PASSWORD('...') fail?
The PASSWORD() function was deprecated in MySQL 5.7 and removed in MySQL 8.0. Use the plain string form: SET PASSWORD FOR 'user'@'host' = 'new_password';. MariaDB is the exception. It still requires PASSWORD() in SET PASSWORD.

Conclusion #

ALTER USER is the one command to remember for changing passwords on modern MySQL and MariaDB servers, and you do not need FLUSH PRIVILEGES with it. For the full set of account and privilege commands, see the guide on how to manage MySQL user accounts and databases .

About the authors

Dejan Panovski

Dejan Panovski is the founder of Linuxize, an RHCSA-certified Linux system administrator and DevOps engineer based in Skopje, Macedonia. Author of 1000+ Linux tutorials with 20+ years of experience turning complex Linux tasks into clear, reliable guides.

View author page