MySQL ERROR 1698: Access denied for user 'root'@'localhost'

1. About the error
2. Why do I see this error
3. Solution
4. Log in the way the plugin expects
5. Switch root to password authentication
6. Better: create a dedicated app user

#About the error

ERROR 1698 (28000): Access denied for user 'root'@'localhost'

You're certain the password is correct, yet mysql -u root -p is rejected. This is the signature of the auth_socket authentication plugin, and it's specifically a 1698, not the 1045 access denied you'd get from genuinely wrong credentials.

#Why do I see this error

On modern Ubuntu/Debian, the MySQL root account is created to authenticate with the auth_socket (or unix_socket) plugin instead of a password. That plugin checks the operating system user running the client: if the OS user is root, it lets you in; otherwise it refuses, regardless of any password.

So mysql -u root -p as a normal user fails, while sudo mysql (running as the OS root) succeeds.

#Solution

#Log in the way the plugin expects

The quickest path in is simply:

sudo mysql

No password, because auth_socket trusts the OS root user.

#Switch root to password authentication

If you want classic password login (for a GUI client or a remote tool), change the plugin for the root account. Log in with sudo mysql, then:

ALTER USER 'root'@'localhost' IDENTIFIED WITH caching_sha2_password BY 'your-strong-password';
FLUSH PRIVILEGES;

On older MySQL/MariaDB use mysql_native_password instead of caching_sha2_password.

#Better: create a dedicated app user

Rather than handing your application the root account, create a least-privilege user scoped to one database:

CREATE USER 'app'@'localhost' IDENTIFIED BY 'your-strong-password';
GRANT ALL PRIVILEGES ON my_app.* TO 'app'@'localhost';
FLUSH PRIVILEGES;

Then point your app at app rather than root. See environment variables in Laravel for wiring the credentials in.