Introduction

This error usually means the MySQL server and client library disagree about the authentication method. In MySQL 8, caching_sha2_password became the default plugin, but many older drivers and tools only understand mysql_native_password.

Why the error happens

Authentication in MySQL is plugin-based. The server stores a user account with a specific authentication plugin, and the client must support that plugin when it connects.

If the account uses caching_sha2_password and the client is too old or misconfigured, connection attempts fail with an error like this:

Unable to load authentication plugin 'caching_sha2_password'

That usually points to one of these situations:

• an outdated connector or ORM driver
• a bundled native client library that lacks plugin support
• a container or application image using older MySQL tooling
• a connection string missing options required by the driver

Best fix: update the client library

The safest solution is usually to upgrade the client or connector so it supports modern MySQL authentication.

Examples include:

• updating mysqlclient, mysql-connector-python, or PyMySQL in Python projects
• updating JDBC connectors in Java applications
• updating MySQL Workbench, CLI tools, or ORM dependencies

This is the preferred fix because it preserves the stronger authentication scheme instead of downgrading the server account.

Temporary compatibility fix: change the user plugin

If upgrading is not possible immediately, you can switch the affected account to mysql_native_password.

ALTER USER 'app_user'@'%' IDENTIFIED WITH mysql_native_password BY 'strong-password';
FLUSH PRIVILEGES;

Then reconnect with the same username and password.

You can inspect the current plugin for accounts with:

SELECT user, host, plugin
FROM mysql.user;

Use this workaround carefully. It improves compatibility, but it is usually a step backward in security compared with keeping caching_sha2_password and upgrading the client.

JDBC and connection-string nuances

Some MySQL drivers support the plugin but still need correct connection options. For example, when RSA key retrieval is involved, some clients need an option such as allowPublicKeyRetrieval=true during development.

A JDBC URL may look like this:

jdbc:mysql://localhost:3306/appdb?useSSL=false&allowPublicKeyRetrieval=true

That is driver-specific, so it is not a universal fix. But it is worth checking your connector documentation before changing server-side authentication.

Docker and packaged runtime cases

This issue often appears in containers where the application image ships an old database client while the server runs MySQL 8. In that situation, the practical fix is usually to rebuild the image with newer dependencies rather than altering the database globally.

That keeps the compatibility fix scoped to the application that actually needs it.

Common Pitfalls

The biggest mistake is immediately downgrading every MySQL user to mysql_native_password without first checking whether the client can simply be upgraded.

Another issue is changing one account but testing with another. If the failing application uses a different username or host pattern, altering the wrong account will not help.

It is also easy to forget that some client errors are really library-loading problems. If a connector cannot find the right shared library or plugin files, the message may look like an authentication problem even though the install itself is broken.

Finally, do not treat allowPublicKeyRetrieval=true as a universal cure. It helps some drivers in some environments, but it does not replace actual plugin support.

Summary

• The error usually means the client does not support the account's caching_sha2_password plugin.
• Updating the client library is usually the best fix.
• If necessary, you can temporarily switch a user to mysql_native_password with ALTER USER.
• Check the exact account and plugin in mysql.user before changing anything.
• Connection-string options can matter, but they are driver-specific and not a substitute for compatibility.