Supabase password authentication failed: what to check
Check the database password and endpoint-specific username when a Supabase SQL login fails. A project API key won’t work as a PostgreSQL password. Copy the connection details together so you don’t mix values from different modes.
Copy the connection details as a set
Open the project's Connect panel, choose the intended connection mode, and copy its host, port, username and database together. Direct and pooled usernames can differ. A host from one mode and a username from another can look reasonable together and still fail to connect.
Supabase's authentication troubleshooting guide recommends checking the username before assuming the password is wrong. If you have several projects, verify the selected project too.
Distinguish a password field from a URI
In a dedicated password field, enter the actual database password. In a connection URI, reserved characters must be percent-encoded appropriately. A literal delimiter such as @ can otherwise be interpreted as part of the URI structure. Avoid double-encoding a value that was already encoded.
When unsure, fill the separate host, port, username, database and password fields. This removes URI parsing as a variable. Never paste a real connection string into a public decoder, forum post or screenshot. See the provider's connection documentation.
After a password change
Check that the client is using the newly saved credential rather than an old stored value. If the shared pooler still fails immediately after rotation, follow the provider's password-rotation troubleshooting rather than rotating repeatedly. Also consider other applications that may still be retrying with the old credential.
Stop when the error category changes
Repeated failed attempts can trigger protective behavior. If authentication failure becomes refusal or a circuit-breaker error, preserve that new message and follow its specific recovery guidance. A longer list of guessed passwords is not a diagnosis.
Once connected, run SELECT current_database(), current_user; and confirm the intended project and role before browsing or editing. In plainDB, label the saved connection clearly so production and development are easy to distinguish. Use a restricted SQL role for routine inspection where possible; a working administrative connection can see more than an end user's API session.
Continue reading
Set up plainDB with Supabase · Choose a connection mode
For the desktop workflow, compare plainDB features on Mac and Windows or download the 14-day trial.