MongoDB stores credentials differently than MySQL or PostgreSQL

MongoDB doesn't use a traditional username and password file the way relational databases do. Instead, you create users within MongoDB itself, and those credentials are stored in the database's internal authentication system. If you're running MongoDB locally for development, you may not need authentication at all — but if you're connecting from another machine, storing data you care about, or preparing for production, you'll want to set up a user account.

The process depends on whether MongoDB is already running and whether you've enabled authentication. Most people either create a user through the MongoDB shell (called mongosh) or through MongoDB Atlas, which is MongoDB's cloud hosting service. We'll cover both paths here.

Key Takeaways

  • MongoDB users are created inside the database itself using the mongosh shell or a GUI tool, not through a separate configuration file.
  • You must connect to MongoDB first (usually on localhost:27017 for a local installation) before you can create a user account.
  • Each user is tied to a specific database and has a role that determines what they can do — "dbOwner" gives full control of one database, while "root" gives control of everything.
  • Once you create a user, you'll use that username and password in your connection string, which looks like mongodb://username:password@localhost:27017/databasename.
  • If you're using MongoDB Atlas instead of a local installation, you create users through the web dashboard rather than the shell.

Creating a user in MongoDB shell (mongosh)

Start by opening a terminal or command prompt and connecting to MongoDB. If MongoDB is running on your machine, type mongosh and press Enter. You should see a prompt that says test> — this means you're connected to MongoDB's default "test" database.

Switch to the database where you want to create the user. If you want to create a user for a database called "myapp", type use myapp and press Enter. If that database doesn't exist yet, MongoDB will create it when you first write data to it. Then run this command:

db.createUser({ user: "myusername", pwd: "mypassword", roles: [ { role: "dbOwner", db: "myapp" } ] })

Replace "myusername" with the name you want, "mypassword" with a strong password, and "myapp" with your actual database name. The role "dbOwner" means this user can read, write, and manage that specific database. If the command succeeds, you'll see a message confirming the user was created.

Understanding MongoDB roles and what they let users do

MongoDB has several built-in roles, and the one you choose determines what the user can do. The most common ones are:

dbOwner — can read and write data in one specific database, create indexes, and manage that database. This is the right choice for most process users. read — can only read data from a database, not write or change anything. Use this for reporting tools or read-only access. readWrite — can read and write data but cannot create users or change database settings. root — can do anything in any database on the entire MongoDB server. Only create a root user if you need to manage multiple databases or the server itself.

If you need a user with a different role, you can create them the same way but swap out the role name. For example, to create a read-only user for "myapp":

db.createUser({ user: "readonly", pwd: "readonlypass", roles: [ { role: "read", db: "myapp" } ] })

Enabling authentication so MongoDB actually checks usernames and passwords

Creating a user doesn't automatically force MongoDB to require a password when someone connects. You have to enable authentication in MongoDB's configuration file. On Windows, this file is usually at C:\Program Files\MongoDB\Server\[version]\mongod.cfg. On Mac or Linux, it's often at /etc/mongod.conf.

Open the configuration file in a text editor and find the section that says security:. Add or uncomment this line under it:

authorization: enabled

Save the file, then restart MongoDB. On Windows, you can restart it through Services. On Mac or Linux, use sudo systemctl restart mongod. After the restart, MongoDB will require a username and password for any connection.

Connecting to MongoDB with your new username and password

Once you've created a user and enabled authentication, you'll need to include the credentials in your connection string. The format is:

mongodb://username:password@localhost:27017/databasename

Replace "username" and "password" with what you created, and "databasename" with the database the user has access to. If your password contains special characters like @ or :, you need to URL-encode them — for example, @ becomes %40. Most MongoDB drivers and tools (like MongoDB Compass, the GUI client) have a field where you can paste this connection string.

To test the connection in mongosh, you can disconnect and reconnect with credentials:

mongosh "mongodb://myusername:mypassword@localhost:27017/myapp"

Creating users in MongoDB Atlas (cloud-hosted MongoDB)

If you're using MongoDB Atlas instead of running MongoDB locally, you create users through the web dashboard. Log in to your Atlas account, click on your cluster, then go to the "Database Access" tab on the left. Click "Add New Database User".

Choose "Password" as the authentication method, enter a username and password, and select which databases this user can access. You can give them a specific role like "dbOwner" or "read" just like in the shell. Click "Add User" and Atlas will generate a connection string for you that includes the username and password.

Atlas also lets you restrict which IP addresses can connect using that username, which adds a layer of security. You can add your home or office IP address, or allow access from anywhere if you're still developing.

Common mistakes and how to fix them

The most common error is trying to create a user before connecting to the right database. If you run db.createUser() while connected to the "test" database, the user will be created in "test", not in "myapp". Always run use myapp first.

Another mistake is creating a user but forgetting to enable authentication in the configuration file. The user exists, but MongoDB won't check for it on connection. If you can still connect without a password after creating a user, authentication isn't enabled yet.

If you forget the password for a user you created, you can change it by running db.changeUserPassword("username", "newpassword") in the mongosh shell while connected as an admin or root user. You cannot retrieve the old password — you can only set a new one.

Frequently Asked Questions

Can I create a MongoDB user without the mongosh shell?

Yes. MongoDB Compass, the official GUI client, has a "Users" tab where you can create and manage users without typing commands. You can also create users through MongoDB Atlas if you're using their cloud service. The shell is the fastest way, but not the only way.

What's the difference between a MongoDB user and a system user?

A MongoDB user is an account inside the database that you use to connect and run queries. A system user is an operating system account on the machine where MongoDB runs. They're separate — creating a MongoDB user doesn't create a system user, and vice versa.

Do I need a password if MongoDB is only running on my local machine?

Not for development. If no one else can access your machine and you're just testing, you can leave authentication disabled. For anything you care about or anything that runs on a server other people can reach, you should create a user and enable authentication.

Can one user access multiple databases?

Yes, but you have to create them with the right role. A user with the "root" role can access any database. A user with "dbOwner" for database "myapp" can only access "myapp". If you need one user to read from "myapp" and write to "otherapp", you'd create them with roles for both databases in the same createUser command.

What happens if I lose the password for my root user?

If authentication is enabled and you lose the root password, you'll need to restart MongoDB with authentication disabled, create a new root user, then re-enable authentication. This is why it's important to store your root password somewhere safe, like a password manager.