Reset a forgotten MySQL or MariaDB root password

Lost the database root password? As long as you have root access to the server itself, you can reset the MySQL root password without losing any data. This guide covers MySQL 8 and MariaDB 10.4+ on Ubuntu, Debian, AlmaLinux and Rocky.

Before you start

• Root SSH access to the server (this does not work from a shared hosting account).
• A short maintenance window: the method below briefly restarts the database.
• Find out which server you run: mysql --version.

First try socket authentication

Many installs let the Linux root user log in to the database without a password through the unix_socket or auth_socket plugin. Try:

sudo mysql

On Debian/Ubuntu you can also try sudo mysql --defaults-file=/etc/mysql/debian.cnf. If you get a mysql> or MariaDB> prompt, skip to Set the new password; no restart is needed.

Restart without permission checks

If socket login fails, start the server with grant tables disabled. It then accepts any login, so block network access while you do this.

1. Stop the database:
   Copy

   systemctl stop mysql

   (The service may be called mysqld or mariadb.)
2. Start it with permission checks off and networking disabled. On systemd systems, set an environment option and start the service:
   Copy

   systemctl set-environment MYSQLD_OPTS="--skip-grant-tables --skip-networking"

   Copy

   systemctl start mysql

   On MariaDB use systemctl start mariadb with the same environment variable.
3. Log in without a password:
   Copy

   mysql -u root

Set the new password

When started with --skip-grant-tables, load the privilege tables first:

FLUSH PRIVILEGES;

Then set the password. MySQL 8:

ALTER USER 'root'@'localhost' IDENTIFIED BY 'New-Strong-Password';

MariaDB 10.4+ (keeps socket login working as well as the password):

ALTER USER 'root'@'localhost' IDENTIFIED VIA unix_socket OR mysql_native_password USING PASSWORD('New-Strong-Password');

Exit with \q.

Return to normal mode

systemctl stop mysql

systemctl unset-environment MYSQLD_OPTS

systemctl start mysql

Test the new password:

mysql -u root -p

Store the password safely

Save it in your password manager. For scripts and backups, put it in /root/.my.cnf with chmod 600 instead of typing it on the command line.

Troubleshooting

• ERROR 1290: running with the --skip-grant-tables option: run FLUSH PRIVILEGES; first, then the ALTER USER statement.
• Service fails to start with the environment variable: your distro's unit may not read MYSQLD_OPTS. Instead add skip-grant-tables and skip-networking under [mysqld] in a config file temporarily, then remove them.
• Access denied for user 'root'@'localhost' after reset: the account may use socket auth only. Log in with sudo mysql and set the password plugin as shown above.
• Applications broke after the change: apps should never use root. Create a separate user for each app with only its own database privileges.

MySQL root password FAQ

Will resetting the root password delete data?

No. Only the account's credentials change; databases are untouched.

Why does sudo mysql work without a password?

The root database account uses socket authentication, which trusts the Linux root user. That is the secure default on Debian, Ubuntu and MariaDB.

How do I change a database user's password on cPanel?

Use cPanel → Databases → Manage My Databases, where you can change passwords for your MySQL users.

Next steps

• MySQL databases and users in cPanel
• Back up MySQL with mysqldump
• systemd and journalctl basics