How to Change MySQL Root Password on Ubuntu (All Methods)

Whether you just installed MySQL on Ubuntu, inherited a server from someone else, or simply want to rotate credentials as part of good security hygiene, you will eventually need to change the MySQL root password. On Ubuntu this is not quite as simple as typing a new password: out of the box, the root@localhost account uses the auth_socket plugin, which means it authenticates you through your Linux login instead of a password at all.

In this guide you will learn every reliable way to change the MySQL root password on Ubuntu 22.04 and 24.04 running MySQL 8.x: the recommended ALTER USER method, the classic mysqladmin shortcut, and the full recovery procedure for when the password is completely forgotten. Each method includes the exact commands and an explanation of what each one does.

Prerequisites

• Ubuntu 22.04 or 24.04 with MySQL 8.x installed (works on both MySQL 8.0 and the 8.4 LTS release).
• Sudo access to the server. All recovery steps are done as the OS root user or with sudo.
• MySQL server running: check with sudo systemctl status mysql.
• A new strong password in mind: at least 12 characters, mixed case, digits, and a symbol.

Step 1: Understand how Ubuntu's MySQL root login works

Before changing anything, log in to MySQL the Ubuntu way:

sudo mysql

The sudo is not optional. On Ubuntu, the MySQL root account is created with the auth_socket authentication plugin, which trusts anyone logged in as the Linux root user. That is why plain mysql -u root -p fails out of the box with ERROR 1698 (28000): Access denied for user 'root'@'localhost'.

Check which plugin your root account currently uses:

sudo mysql -e "SELECT user, host, plugin FROM mysql.user WHERE user='root';"

This prints the root account's row from the user table. If plugin says auth_socket, the account has no password yet and logs in via Linux root. Keep this output in mind: it tells you exactly which method to use next.

Step 2: Change the password with ALTER USER (recommended)

This is the canonical MySQL 8 method. Log in as described above, then run:

ALTER USER 'root'@'localhost' IDENTIFIED WITH mysql_native_password BY 'YourNewStrongPassword123!';

ALTER USER is the supported way to modify account credentials. IDENTIFIED WITH mysql_native_password switches the account from socket-based auth to classic password auth, and BY '...' sets the new password. Use your own strong password instead of the placeholder.

If you would rather keep MySQL's default authentication plugin (caching_sha2_password in MySQL 8.x) and just set a password, drop the plugin clause:

ALTER USER 'root'@'localhost' IDENTIFIED BY 'YourNewStrongPassword123!';

This sets the password while leaving the current default plugin in place. Both forms take effect immediately: ALTER USER handles privilege reloading for you, so no FLUSH PRIVILEGES is needed.

Exit the MySQL shell with:

EXIT;

Step 3: Verify the new password works

Try logging in with the new password from the normal user (no sudo this time):

mysql -u root -p

Type the new password when prompted. If you land at the mysql> prompt, the change worked. Confirm the plugin switched by re-running the check from Step 1:

mysql -u root -p -e "SELECT user, host, plugin FROM mysql.user WHERE user='root';"

The plugin column should now show mysql_native_password (or caching_sha2_password if you used the second form).

Step 4 (alternative): Change it with mysqladmin

If you can already authenticate (either with sudo via auth_socket, or you know the current password), the mysqladmin utility changes the password in one shot:

sudo mysqladmin -u root password 'YourNewStrongPassword123!'

Here sudo provides authentication through the socket plugin, and password is mysqladmin's command to assign a new password to the root account. Verify with mysql -u root -p as in Step 3.

If the account already has a password and you know it, pass it with -p (no sudo needed):

mysqladmin -u root -p password 'YourNewStrongPassword123!'

You will be prompted for the old password first, then the account is updated to the new one. Note that the mysqladmin password command is deprecated in newer MySQL 8 releases, so prefer the ALTER USER method for long-term scripts.

Step 5 (recovery): Reset a forgotten root password

If the password is lost entirely, stop MySQL and restart it with an initialization file that sets a new one. This is MySQL's documented recovery procedure and works on 8.0 and 8.4.

First, stop the server:

sudo systemctl stop mysql

Create an init file containing the password reset (replace the placeholder):

echo "ALTER USER 'root'@'localhost' IDENTIFIED BY 'YourNewStrongPassword123!';" | sudo tee /tmp/mysql-init

tee writes the SQL statement to /tmp/mysql-init with root permissions. Now start MySQL manually, telling it to execute that file on startup:

sudo mysqld --init-file=/tmp/mysql-init &

mysqld runs the server directly (in the background, thanks to &) and --init-file makes it execute your reset statement before accepting connections. Log in with the new password:

mysql -u root -p

Once you are in, shut down the manually started server and restart the normal service:

mysqladmin -u root -p shutdown
sudo systemctl start mysql

The first command stops the background server (it prompts for the new password); the second starts MySQL through systemd as usual. Finally, delete the init file so the password never sits in plain text on disk:

sudo rm /tmp/mysql-init

Verify it worked

Run these checks after any of the methods above:

mysql -u root -p -e "SELECT VERSION();"
sudo systemctl status mysql

The first command proves password authentication works and shows the server version; the second confirms the service is healthy under systemd. If you changed the plugin away from auth_socket, also confirm that plain sudo mysql now asks for a password (or fails) instead of dropping you straight into a shell: that is the expected new behavior.

Common issues and fixes

ERROR 1698 (28000): Access denied for user 'root'@'localhost'

This means the account still uses auth_socket. Do not keep guessing passwords: log in with sudo mysql and switch the account to password auth with the ALTER USER command from Step 2.

ERROR 1819 (HY000): Your password does not satisfy the current policy requirements

The validate_password component rejected your new password. Check the active policy:

sudo mysql -e "SHOW VARIABLES LIKE 'validate_password%';"

Either pick a longer, more complex password, or relax the policy (use with care):

sudo mysql -e "SET GLOBAL validate_password.policy = 'LOW';"

ERROR 2002 (HY000): Can't connect to local MySQL server through socket

The MySQL service is not running. Start it and check the status:

sudo systemctl start mysql
sudo systemctl status mysql

Scripts that relied on passwordless sudo mysql broke

Expected: once root uses password auth, passwordless socket logins stop working. Update those scripts to use mysql -u root -p (or a dedicated user), or switch root back to socket auth if the server is single-purpose:

sudo mysql -e "ALTER USER 'root'@'localhost' IDENTIFIED WITH auth_socket;"

ERROR 1396 (HY000): Operation ALTER USER failed for 'root'@'localhost'

The account name or host is wrong. List all users and use the exact user/host pair shown:

sudo mysql -e "SELECT user, host FROM mysql.user;"

Conclusion

On Ubuntu, changing the MySQL root password is a two-part job: understanding that root starts on auth_socket, then deliberately switching it to password authentication with ALTER USER. Keep the forgotten-password recovery steps somewhere safe, rotate the password periodically, and avoid using the root account for your applications — create dedicated users with least-privilege access instead.

If server setup or database hardening is eating into your team's time, XpertBees helps businesses with Linux server administration, MySQL setup, and security hardening — reach out and we will take it off your plate.