Getting a “401 Unauthorized” when attempting to login/pull from Docker Hub generally means your credentials (or tokens) aren’t accepted, or Docker’s registry is rejecting the request.
Below are possible causes + steps to fix (“DockerHub Down” isn’t really a thing often, but the service can have outages).
🔍 Possible Causes
-
Wrong or expired username / password / token
-
You’re using a limited-scope token (e.g. read-only) and Docker doesn’t accept it in your scenario
-
The Docker client has cached invalid credentials
-
Docker Hub (or the registry) is having a temporary outage or degraded performance
-
Registry URL or endpoint is wrong (e.g. mistyped or using old v1 API)
-
Network proxies/firewalls interfering with the authentication flow
-
Internal Docker config issues (config.json)
-
The registry backend (if self‑hosted) is misconfigured for auth realms / token handling
✅ Steps to Fix / Troubleshoot
Try these in order until one resolves it.
-
Log out / clear credentials, then login fresh
This clears any stale cached credentials that may be rejected.
(This is a known workaround when credentials changed but Docker still holds old ones) -
Use a valid personal access token (PAT) instead of password
-
If your Docker Hub account uses 2FA, you typically can’t use your password for CLI auth; you’ll need a token.
-
Make sure the token has the proper scopes (read/pull, or more) to work with Docker CLI.
-
-
Check token scope / permissions
-
If you used a read-only token or limited-scope token, try generating one with broader permissions (read + write or full) and see if login works. Some users found that limited tokens caused “invalid token / unauthorized” errors.
-
If using Docker Hub’s token system, check that the repository is accessible to your account.
-
-
Verify registry endpoint / URL is correct
Sometimes people accidentally change or misname registry endpoints (e.g.
registry-1.docker.io/v2vsindex.docker.io) or use HTTP instead of HTTPS. Ensure you’re targeting the proper URL. -
Check for Docker Hub outage / status
-
Visit Docker’s status page (e.g. status.docker.com) to see if there is an authentication / registry outage.
-
The error “Image pull returns 401 Unauthorized” was reported as an incident before.
-
If Docker Hub is actually down or degraded, you may have to wait until it’s resolved.
-
-
Inspect your
~/.docker/config.json-
After login, Docker stores auth tokens in
~/.docker/config.json. Make sure the file is valid (no syntax errors, no malformed entries). -
Remove obsolete or malformed credentials.
-
-
Check network / firewall / proxy
-
If you’re behind a corporate proxy or firewall, it may block or interfere with the authentication handshake.
-
Try from a different network (e.g. mobile hotspot) to see if the issue is network-specific.
-
-
Try with verbose / debug modes
Run:
or
to get more details about what’s failing in the HTTP / token exchange.
-
Wait and retry
If it’s a transient outage or glitch in Docker Hub, retrying after some minutes or an hour might succeed.
Be the first to comment