Introduction

MongoDB does not have a default username or password. When you install MongoDB and start it for the first time, authentication is disabled entirely. Any client that can reach the server can read and write any database without credentials. This is by design for local development convenience, but it is a critical security risk for any networked or production deployment.

The correct first step after installation is to create an admin user, enable authentication, and restart the server with access control enforced.

Why There Are No Default Credentials

Unlike databases such as MySQL (which has a root user with an empty or generated password) or PostgreSQL (which uses OS-level peer authentication), MongoDB ships with no users at all. The authentication system is simply turned off until you explicitly enable it.

This means:

MongoDB listens on localhost:27017 by default, which limits exposure on a single machine. But if bindIp is changed to 0.0.0.0 or a public interface without first enabling authentication, the database is open to the network.

Creating the First Admin User

The process has three steps: connect to the server, create a user in the admin database, and then enable authentication in the server configuration.

Step 1: Connect Without Authentication

Since no users exist yet, connect to the running mongod instance directly:

1# Using mongosh (MongoDB Shell, version 6.0+)
2mongosh
3
4# Or using the legacy mongo shell
5mongo

Step 2: Create an Admin User

Switch to the admin database and create a user with administrative privileges:

1use admin
2
3db.createUser({
4  user: "adminUser",
5  pwd: passwordPrompt(),   // prompts for password interactively
6  roles: [
7    { role: "userAdminAnyDatabase", db: "admin" },
8    { role: "readWriteAnyDatabase", db: "admin" }
9  ]
10})

The passwordPrompt() function avoids putting the password in your shell history. If you need to script user creation, you can pass the password directly:

1db.createUser({
2  user: "adminUser",
3  pwd: "your-secure-password-here",
4  roles: [
5    { role: "userAdminAnyDatabase", db: "admin" },
6    { role: "readWriteAnyDatabase", db: "admin" }
7  ]
8})

Step 3: Enable Authentication

Edit the MongoDB configuration file (typically /etc/mongod.conf on Linux or mongod.cfg on Windows):

security:
  authorization: enabled

Then restart MongoDB:

1# Linux (systemd)
2sudo systemctl restart mongod
3
4# macOS (Homebrew)
5brew services restart mongodb-community
6
7# Windows (services)
8net stop MongoDB && net start MongoDB

After restart, unauthenticated connections are rejected.

Connecting with Credentials

Once authentication is enabled, you must provide credentials to connect.

From the Shell

mongosh -u adminUser -p --authenticationDatabase admin

The -p flag without a value prompts for the password. You can also specify it inline, but that exposes it in process listings and shell history:

mongosh -u adminUser -p 'your-secure-password-here' --authenticationDatabase admin

Using a Connection String

mongodb://adminUser:your-secure-password-here@localhost:27017/?authSource=admin

The authSource=admin parameter is essential. It tells MongoDB which database contains the user credentials. Omitting it causes authentication to fail even with correct credentials, because MongoDB defaults to looking for the user in the database being connected to.

From Application Code

1# Python (pymongo)
2from pymongo import MongoClient
3
4client = MongoClient(
5    "mongodb://adminUser:your-secure-password-here@localhost:27017/?authSource=admin"
6)
7db = client["myapp"]
8print(db.list_collection_names())

1// Node.js (mongodb driver)
2const { MongoClient } = require('mongodb');
3
4const uri = "mongodb://adminUser:your-secure-password-here@localhost:27017/?authSource=admin";
5const client = new MongoClient(uri);
6
7async function run() {
8    await client.connect();
9    const db = client.db("myapp");
10    const collections = await db.listCollections().toArray();
11    console.log(collections);
12    await client.close();
13}
14
15run();

Creating Application-Specific Users

The admin user should not be used by applications. Create scoped users with minimum necessary privileges:

1use admin
2
3// Read-write access to a specific database
4db.createUser({
5  user: "appUser",
6  pwd: passwordPrompt(),
7  roles: [
8    { role: "readWrite", db: "myapp" }
9  ]
10})
11
12// Read-only access for reporting
13db.createUser({
14  user: "reportUser",
15  pwd: passwordPrompt(),
16  roles: [
17    { role: "read", db: "myapp" }
18  ]
19})

Key Built-in Roles

MongoDB in Docker

The official MongoDB Docker image supports setting initial credentials through environment variables:

1docker run -d \
2  --name mongodb \
3  -p 27017:27017 \
4  -e MONGO_INITDB_ROOT_USERNAME=adminUser \
5  -e MONGO_INITDB_ROOT_PASSWORD=securePassword \
6  -v mongodb_data:/data/db \
7  mongo:7

This creates the root user and enables authentication automatically. No manual user creation step is needed.

In Docker Compose:

1services:
2  mongodb:
3    image: mongo:7
4    ports:
5      - "27017:27017"
6    environment:
7      MONGO_INITDB_ROOT_USERNAME: adminUser
8      MONGO_INITDB_ROOT_PASSWORD: securePassword
9    volumes:
10      - mongodb_data:/data/db
11
12volumes:
13  mongodb_data:

Initialization Scripts

You can mount JavaScript files to /docker-entrypoint-initdb.d/ to create application-specific users and databases on first start:

1// init-users.js (mounted to /docker-entrypoint-initdb.d/)
2db = db.getSiblingDB('myapp');
3
4db.createUser({
5  user: 'appUser',
6  pwd: 'app-password',
7  roles: [{ role: 'readWrite', db: 'myapp' }]
8});
9
10db.createCollection('users');

MongoDB Atlas (Cloud)

If you are using MongoDB Atlas (the managed cloud service), there are no server-level defaults to worry about. Atlas requires you to create database users through the web console or API before any client can connect. Atlas also enforces network access lists (IP allowlists) by default.

# Connect to Atlas
mongosh "mongodb+srv://cluster0.abc123.mongodb.net/myapp" --username atlasUser

Atlas users are managed separately from the database's built-in user system, and authentication is always enabled.

Security Checklist for Production

After moving beyond development, verify these settings:

1. Authentication is enabled in mongod.conf (security.authorization: enabled)
2. Admin user exists with a strong password
3. Application users are scoped to specific databases with minimal roles
4. Network binding is restricted (bindIp set to specific interfaces, not 0.0.0.0)
5. TLS/SSL is enabled for encrypted connections
6. Firewall rules restrict access to port 27017
7. Audit logging is enabled for compliance requirements

1# Production mongod.conf example
2security:
3  authorization: enabled
4
5net:
6  bindIp: 127.0.0.1,10.0.1.5
7  tls:
8    mode: requireTLS
9    certificateKeyFile: /etc/ssl/mongodb.pem
10    CAFile: /etc/ssl/ca.pem

Common Pitfalls

Assuming MongoDB has default credentials like admin/admin or root/root and spending time trying them is a common waste of effort. There are no built-in credentials of any kind.

Forgetting to specify authSource=admin in the connection string causes "authentication failed" errors even when the username and password are correct. The default auth source is the target database, not admin.

Enabling authentication before creating any user locks you out of the database. Always create the admin user first, then enable auth and restart.

Exposing MongoDB to the internet (bindIp: 0.0.0.0) without authentication has led to numerous data breaches. Botnets actively scan for open MongoDB instances on port 27017.

Using the admin/root user for application connections violates the principle of least privilege. Create dedicated users with scoped roles for each application.

Putting passwords directly in connection strings that end up in source control or logs is a security risk. Use environment variables, secrets managers, or passwordPrompt() for interactive sessions.

Summary

• MongoDB has no default username or password. Authentication is disabled on fresh installations.
• Create an admin user, enable security.authorization in the config file, and restart the server to enforce authentication.
• Always specify authSource=admin in connection strings when authenticating against the admin database.
• Create scoped, application-specific users with the minimum necessary roles instead of sharing admin credentials.
• In Docker, use MONGO_INITDB_ROOT_USERNAME and MONGO_INITDB_ROOT_PASSWORD environment variables to bootstrap authentication automatically.
• For production, enable TLS, restrict network binding, and audit access in addition to authentication.