Skip to main content
To reset the MySQL root password, first try sudo mysql (or sudo mariadb): on Ubuntu and Debian root often logs in through the Linux socket with no password, and you can run ALTER USER straight away. If that fails, add skip-grant-tables and skip-networking to the server config, restart, run FLUSH PRIVILEGES; and ALTER USER 'root'@'localhost' IDENTIFIED BY 'new-password';, then remove the two lines and restart again.

Before you start

  • You need sudo or root on the Linux server. This guide resets the database root password, not your Linux login. For a lost Linux root password on a VPS, see reset your VPS root password.
  • Websites lose database access for a minute or two during the reset. Do it at a quiet time.
  • Take a snapshot or back up the data folder if you can.

Step 1: Try socket login first

If you get a prompt such as MariaDB [(none)]> or mysql>, you are in. Set a new password and you are done:
This keeps sudo mariadb working and sets a password.
The MariaDB documentation puts it simply: if you have forgotten the root password, you can still connect using sudo and change it. If you see ERROR 1045 (28000): Access denied for user 'root'@'localhost', root uses a password only. Continue with step 2.

Step 2: Reset the password with skip-grant-tables

skip-grant-tables starts the server without checking any passwords. skip-networking makes sure nobody can connect over the network while it runs.
While skip-grant-tables is active, anyone with a shell on the server can open any database without a password. Never leave it in place, and always use it together with skip-networking.
1

Create a temporary config file

Add these lines and save:
2

Restart the database server

The service is mysql for MySQL on Ubuntu and mysqld for MySQL on AlmaLinux / Rocky.
3

Log in without a password

4

Reload the grant tables and set the password

ALTER USER does not work until you reload the grant tables, so run FLUSH PRIVILEGES first.
5

Remove the temporary file and restart

How to check it worked

Log in with the new password over TCP:
Because -h 127.0.0.1 connects over the network, this only works once skip-networking is gone, which also proves the server is back to normal. If you see Can't connect to server on '127.0.0.1', the temporary file is still being read. Remove it and restart.

What if I cannot log in to the server at all?

If you are locked out of SSH too, use the VPS console instead. See use the VNC console or use rescue mode. On a dedicated server, open a ticket for console access.

Frequently asked questions

Why does the server not start after adding skip-grant-tables?

Check the log with sudo journalctl -u mariadb -n 50 (or -u mysql / -u mysqld). A typo in the .cnf file is the usual cause. See read logs with journalctl.

Can I reset a normal user’s password the same way?

You do not need to. Log in as root and run ALTER USER 'shopuser'@'localhost' IDENTIFIED BY 'N3w-Pass!';. See create a database and user.

Should root have a password at all?

On Ubuntu and Debian, socket login for root is safer for daily admin work. Give apps and tools such as phpMyAdmin their own users instead of root.

Does resetting the root password delete any data?

No. Only the root account’s login changes. Your databases are not touched.

VPS and dedicated server guides

Every guide in this section.

Secure MySQL and MariaDB

Set root up safely from the start.

Manage services with systemctl

Start, stop and restart MySQL.

Back up and restore MySQL

Protect your data first.

VNC console

Get in when SSH does not work.

Checked against the official MySQL 8.0 Reference Manual and MariaDB documentation on 4 November 2026; the skip-grant-tables reset and MariaDB ALTER USER statements tested on Ubuntu 24.04 LTS with MariaDB 10.11. Commands can differ on other distributions or releases.

Need Extra Help?

If you encounter any issues, our support team is ready to assist:

Save on Your Hosting

Ready to upgrade your hosting? Use code KB20 at checkout for 20% off your first order!

Last Updated: November 2026