Getting a “401 Unauthorized” when attempting to login/pull from Docker Hub generally means your credentials (or tokens) aren’t accepted, or Docker’s registry is rejecting the request.
Below are possible causes + steps to fix (“DockerHub Down” isn’t really a thing often, but the service can have outages).
🔍 Possible Causes
Wrong or expired username / password / token
You’re using a limited-scope token (e.g. read-only) and Docker doesn’t accept it in your scenario
The Docker client has cached invalid credentials
Docker Hub (or the registry) is having a temporary outage or degraded performance
Registry URL or endpoint is wrong (e.g. mistyped or using old v1 API)
Network proxies/firewalls interfering with the authentication flow
Internal Docker config issues (config.json)
The registry backend (if self‑hosted) is misconfigured for auth realms / token handling
✅ Steps to Fix / Troubleshoot
Try these in order until one resolves it.
Log out / clear credentials, then login fresh
This clears any stale cached credentials that may be rejected.
(This is a known workaround when credentials changed but Docker still holds old ones)Use a valid personal access token (PAT) instead of password
If your Docker Hub account uses 2FA, you typically can’t use your password for CLI auth; you’ll need a token.
Make sure the token has the proper scopes (read/pull, or more) to work with Docker CLI.
Check token scope / permissions
If you used a read-only token or limited-scope token, try generating one with broader permissions (read + write or full) and see if login works. Some users found that limited tokens caused “invalid token / unauthorized” errors.
If using Docker Hub’s token system, check that the repository is accessible to your account.
Verify registry endpoint / URL is correct
Sometimes people accidentally change or misname registry endpoints (e.g.
registry-1.docker.io/v2vsindex.docker.io) or use HTTP instead of HTTPS. Ensure you’re targeting the proper URL.Check for Docker Hub outage / status
Visit Docker’s status page (e.g. status.docker.com) to see if there is an authentication / registry outage.
The error “Image pull returns 401 Unauthorized” was reported as an incident before.
If Docker Hub is actually down or degraded, you may have to wait until it’s resolved.
Inspect your
~/.docker/config.jsonAfter login, Docker stores auth tokens in
~/.docker/config.json. Make sure the file is valid (no syntax errors, no malformed entries).Remove obsolete or malformed credentials.
Check network / firewall / proxy
If you’re behind a corporate proxy or firewall, it may block or interfere with the authentication handshake.
Try from a different network (e.g. mobile hotspot) to see if the issue is network-specific.
Try with verbose / debug modes
Run:
or
to get more details about what’s failing in the HTTP / token exchange.
Wait and retry
If it’s a transient outage or glitch in Docker Hub, retrying after some minutes or an hour might succeed.
Be the first to comment