FluentDBFluentDB
PostgreSQL errors

PostgreSQL: password authentication failed for user

FATALSQLSTATE 28P01invalid_password
FATAL: password authentication failed for user "<user>"

The username exists, but the password Postgres received did not match. The cause is usually a wrong or unset password, a special character that was not URL-encoded in your connection string, or a scram-sha-256 versus md5 hashing mismatch.

What this error means

Postgres found the role you connected as, so this is a password problem, not a missing-user problem. The server compared the password you sent against the stored hash for that role and they did not match.

If the role never had a password set, or the connection string mangled it, you get this same error even when you think the password is right.

How to fix it

01

The password is wrong or was never set

Set a known password for the role, then connect with it.

sql
ALTER ROLE myuser WITH PASSWORD 'a-new-strong-password';
02

A special character in the password is not URL-encoded

In a connection URI, characters like @ : / # must be percent-encoded. An @ in the password becomes %40, otherwise the parser reads it as the host separator.

text
postgresql://myuser:p%40ssword@localhost:5432/mydb
03

The stored hash and pg_hba.conf method disagree

If pg_hba.conf requires scram-sha-256 but the password was stored as md5 (or vice versa), auth fails. Set the encoding, then re-set the password so it is re-hashed with the right algorithm.

sql
SET password_encryption = 'scram-sha-256';
ALTER ROLE myuser WITH PASSWORD 'a-new-strong-password';

How to avoid it next time

  • Store credentials in a secrets manager or env var, not scattered across config files where they drift.
  • After changing authentication methods in pg_hba.conf, re-set affected passwords so their hashes match the new method.

Frequently asked questions

How is this different from 'role does not exist'?

That error means the username itself is unknown. This one means the username is valid but the password did not match, so you are closer, it is only the credential that is wrong.

Why does the right password still fail?

Most often a special character in a connection URI was not percent-encoded, or the role's password was hashed with a method your pg_hba.conf no longer accepts. Re-set the password to rule the second one out.

Stop struggling with SQL

Use FluentDB, the AI database client for macOS.