How do I diagnose MySQL Access denied errors?
An Access denied message identifies the attempted account and connection context, not just whether a password was typed. Check username, host matching, transport and target database together. Avoid changing every credential or broadening host access until the failing layer is understood.
Before you start
- The intended database account and approved connection details.
- Access to the account owner or database administrator for permission review.
Instructions
1. Record the error precisely
Note the error number, account, host and whether a password was used. Do not include the actual password in a ticket. A connection-refused or timeout error is a different problem from database authentication rejection.
2. Test the intended local transport explicitly
For a database on this server, use the known TCP listener and a password prompt. Replace the example account and database with the approved values.
mysql --protocol=TCP --host=127.0.0.1 --port=3306 --user=appuser --password appdbTests the specified local TCP path without exposing the password in arguments.
3. Compare the failed context with a working one
If an authorised session works, inspect its identity and grants. Socket authentication, a different client option file or an active role can explain why two clients behave differently.
SELECT USER(), CURRENT_USER(), DATABASE();
SHOW GRANTS FOR CURRENT_USER;Runs only inside a successful MySQL session and reads its privilege context.
Check the result
- The intended client authenticates using the intended account and can perform only the authorised application operations.
Troubleshooting
- Login works without naming a database but fails with appdb
- Check schema privileges and the database name. The account may authenticate successfully yet lack access to that schema.
- The client uses an obsolete authentication method
- Use a supported client compatible with the server’s configured authentication; do not weaken all accounts to accommodate one old client.
Official references
Use the documentation for your installed version when a flag, service name or platform feature differs.