criticalPostgreSQLError 28P01

PostgreSQL Error 28P01: Invalid Password / Authentication Failed

Error Message
FATAL:  password authentication failed for user "postgres"

What is PostgreSQL Error 28P01?

PostgreSQL SQLSTATE 28P01 indicates that the client provided the correct username but the wrong password, or the authentication method in pg_hba.conf requires a password and none was provided.

Common Causes

  • 1

    Wrong password for the PostgreSQL user

  • 2

    Password was changed and the connection string was not updated

  • 3

    pg_hba.conf requires password (md5/scram-sha-256) but client sent none

  • 4

    Authentication method mismatch: client uses md5 but server requires scram-sha-256

  • 5

    Password contains special characters that were not properly escaped in the connection string

Step-by-Step Solutions

1

Reset the password as a superuser: ALTER USER username WITH PASSWORD 'new_password';

2

For locked-out root/postgres user: edit pg_hba.conf to use 'trust' temporarily, reload, reset password, restore to 'md5'

3

Check pg_hba.conf authentication method matches your client configuration

4

URL-encode special characters in the password if using a connection URL string

5

Verify the correct user name: \du in psql lists all users and their attributes

Prevention Tips

  • Use environment variables (PGPASSWORD or .pgpass file) for passwords, not connection string literals

  • Use secrets management tools (Vault, AWS Secrets Manager) for database credentials

  • Implement password expiration policies and update connection strings during rotation

  • Prefer scram-sha-256 over md5 in pg_hba.conf for better security

Frequently Asked Questions

How do I reset a PostgreSQL user password?
Connect as a superuser (e.g., postgres): psql -U postgres. Then: ALTER USER myuser WITH PASSWORD 'new_secure_password'; This takes effect immediately for new connections. If you're locked out of the postgres superuser, edit pg_hba.conf to add: local all postgres trust. Reload: pg_ctl reload. Reset password. Revert pg_hba.conf.
What is the difference between md5 and scram-sha-256 in PostgreSQL?
Both are password-based authentication methods in pg_hba.conf. scram-sha-256 (introduced in PostgreSQL 10) is the modern, secure option — it uses SCRAM protocol which prevents password transmission in recoverable form. md5 is older and less secure (uses MD5 hash which is cryptographically weak). Use scram-sha-256 for all new deployments.

Related Errors

POSTGRESQL 08001POSTGRESQL 08006POSTGRESQL 42501

Still Stuck?

Ask our AI SQL Assistant or the community — get answers in seconds.

Ask AI Assistant Test in Playground