PostgreSQL Error 28P01: Password Authentication Failed

PostgreSQL SQLSTATE 28P01 (invalid_password) means the server rejected password authentication for the requested database role. The password may be wrong or stale, but the client may also be connecting to a different server, port, database, or role than expected. PostgreSQL lists 28P01 in its error-code appendix.

Confirm the connection target and role

Check the host, port, database, and username used by the failing process. Try the same values with psql, leaving the password out of the command so it can prompt securely:

psql "host=db.example.com port=5432 dbname=appdb user=app_user" -W

If this succeeds, update the application’s secret or connection pool configuration and restart the process that holds the old value. If it fails too, continue with a database administrator who can inspect the server-side role and authentication configuration.

Check that the role can log in and has a password

From an administrative database session, confirm the role exists and is allowed to log in:

SELECT rolname, rolcanlogin
FROM pg_roles
WHERE rolname = 'app_user';

If the role has no password, or its password needs to be replaced, use \password in psql to set one:

\password app_user

psql prompts for the new password without placing it in SQL command history or the server log. If you need to reset the local postgres administrator password, see Reset a PostgreSQL role password.

Check the matching pg_hba.conf rule

pg_hba.conf selects an authentication method using the connection type, client address, database, and role. PostgreSQL uses the first matching record; it does not try later records when authentication fails. Ask the database administrator to inspect the matching rule and server log if the expected credentials still fail. See PostgreSQL’s pg_hba.conf documentation.

Do not change a network rule to trust to make a password error disappear. trust accepts the requested database role without verifying a password, including superuser roles, for any client that matches the rule. Use the authentication method and access scope intended for that server; see PostgreSQL’s trust authentication warning.

Distinguish a bad password from an unsupported SCRAM client

If the client reports that it does not support the server’s authentication method, rather than 28P01, update the PostgreSQL driver or client library to one that supports SCRAM-SHA-256. PostgreSQL identifies SCRAM-SHA-256 as its most secure built-in password method and notes that older clients might not support it. Do not switch to clear-text password authentication on an unencrypted connection just to keep an old client working; see PostgreSQL password authentication.

If the connection succeeds but a statement is rejected for missing schema, table, or sequence privileges, see PostgreSQL Error 42501: Permission Denied. Browse the PostgreSQL error troubleshooting index for other SQLSTATEs.