Question 1

What MySQL versions use which format?

Accepted Answer

MySQL 4.0 and earlier used OLD_PASSWORD() — a custom 16-char hex format. MySQL 4.1 through 8.0 use PASSWORD() — double SHA-1 with a leading * (41 chars total). MySQL 8.0+ default authentication plugin is caching_sha2_password which uses a different format ($A$$$) that isn't generated by PASSWORD(). PASSWORD() itself was deprecated in MySQL 5.7 and REMOVED in MySQL 8.0 — you can't run SELECT PASSWORD('x') in MySQL 8+. This tool generates the PASSWORD() format anyway because many existing user records still use it.

Question 2

Where does this go in the database?

Accepted Answer

In MySQL 5.7 and earlier, the column is mysql.user.password (40 hex chars + leading *). In MySQL 8.0+ migrated from older versions, the column is mysql.user.authentication_string with the same format. To set a user's password to a known hash: `UPDATE mysql.user SET authentication_string='*ABC...' WHERE User='someuser'; FLUSH PRIVILEGES;`. Note that MySQL 8.0+ may require you to also change the user's authentication plugin to mysql_native_password if the user was created with caching_sha2_password.

Question 3

What about caching_sha2_password?

Accepted Answer

caching_sha2_password is MySQL 8.0+'s default — a much stronger format using SHA-256 with random salt and iteration count. Format: $A$$. It's not generated by PASSWORD() and isn't directly compatible with this tool. To work with caching_sha2_password, use MySQL's own ALTER USER syntax: `ALTER USER 'u'@'%' IDENTIFIED WITH caching_sha2_password BY 'newpassword'`. For new MySQL 8.0+ installations, prefer this over PASSWORD().

MySQL Password Hash Generator

Frequently Asked Questions