What port does MySQL use on Mac?

The default MySQL/MariaDB port is 3306. Local Docker setups sometimes map a different host port — check your compose file or container publish settings.

Why does MySQL say “Access denied” on Mac?

Usually wrong password, wrong auth plugin expectations, or connecting as a user that only allows socket auth. Create a user with mysql_native_password/caching_sha2_password as required and grant privileges.

Can I connect from Mac to a remote production database?

Yes, preferably through an SSH tunnel or VPN rather than exposing port 3306 to the public internet.

How to Connect to MySQL on Mac (Without Living in the Terminal)

Connecting to MySQL on a Mac should not require memorizing five flags. This walkthrough shows how to connect to MySQL on Mac with a desktop client — local Docker, Homebrew installs, and remote servers included — plus the errors Mac users hit most often.

Before you open a GUI

You need:

A running MySQL or MariaDB server
A username and password (or socket auth setup)
Host + port (default 3306)
Optional: SSH access for remote servers

Verify the server from Terminal first:

mysql -h 127.0.0.1 -P 3306 -u root -p

If the CLI fails, fix that before blaming the GUI.

Local options on macOS

Docker (very common)

Example publish:

docker run --name mysql -e MYSQL_ROOT_PASSWORD=secret -p 3306:3306 -d mysql:8.4

GUI settings:

Host: 127.0.0.1
Port: 3306
User: root
Password: secret

Prefer 127.0.0.1 over localhost on Mac when something mysteriously fails — localhost can resolve to a socket path the container does not use.

Homebrew MySQL / MariaDB

After brew services start mysql (or mariadb), connect with the credentials you set during install. Again, try 127.0.0.1 if socket auth confuses your GUI.

MAMP / Laravel Herd / other stacks

Check the stack’s MySQL port. It is not always 3306. Use the port the stack UI shows.

Connect with a desktop client (TabulaSQL example)

Download TabulaSQL for Mac
Open the app (right-click → Open if Gatekeeper blocks an unsigned build)
Create a new connection
Fill host, port, user, password, optional default database
Click Test connection, then save

Passwords should be stored encrypted on your machine. You should not need an account to talk to a database on your own laptop.

Remote MySQL from a Mac

Do not open port 3306 to the entire internet if you can avoid it. Prefer:

SSH tunnel through a bastion
VPN into the private network
managed DB “allowlist” + SSL when a vendor requires it

For SSH tunneling details, see MySQL GUI with SSH tunnel.

Typical split credentials:

SSH user/key → jump host
MySQL user/password → database

They are not the same thing.

SSL connections

Some hosts require TLS. In your GUI:

enable SSL/TLS
provide CA certificate if the host documents one
avoid “accept anything” modes for production

If a managed MySQL insists on SSL and your GUI ignores it, the server will reject the handshake even with a perfect password.

Common Mac connection errors

Access denied for user

Wrong password, wrong auth plugin, or host mismatch (user@localhost vs user@%). Create/fix the user on the server and flush privileges.

Can’t connect to MySQL server on '127.0.0.1'

Server not running, wrong port, or Docker not publishing the port. Check docker ps and lsof -i :3306.

Connection refused over SSH

Bastion firewall, wrong SSH user, or key not loaded in the agent (ssh-add -l).

App “is damaged” / can’t be opened

Unsigned macOS builds may need right-click → Open, or clearing quarantine:

xattr -cr /Applications/TabulaSQL.app

Minimal security checklist

separate users per app/environment
no shared root passwords in chat
read-only user for production exploration
SSH or VPN for remote access
backups before bulk GUI edits

Next steps after you connect

run SELECT VERSION(); and confirm you hit the server you think you hit
open the schema browser and locate your app database
save the connection with a clear color/label (local, staging)
set up SSH for staging so you never fall back to a public 3306