MySQL Password Hash Generator
Scripts and migrations should not contain plain-text MySQL passwords, and you often need a hash before the account exists: for a provisioning file, for a Kubernetes secret, or to copy a user to another server. This tool computes the value MySQL stores in mysql.user.authentication_string, right in your browser. It supports caching_sha2_password (the $A$005$ format, 5,000 rounds of SHA-256 crypt with a 20-byte salt) and mysql_native_password (an asterisk followed by double SHA-1). You get ready-to-run CREATE USER and ALTER USER statements that use IDENTIFIED WITH plugin AS, so the password itself never appears in SQL. Verify mode goes the other way: paste a password and a stored hash, including the HEX(authentication_string) output of caching_sha2_password, and it tells you whether they match and shows the rounds and salt. The tool also runs the rules of the default validate_password policy, because the server cannot check a password it only receives as a hash. Results were tested against real servers: 400 hashes generated by MySQL 8.4.11 were reproduced byte for byte, 60 accounts created from this tool's hashes logged in, 300 native hashes matched, and 2,500 random passwords got the same policy verdict as the component, with hashes also accepted by MySQL 8.0.46. No password or hash is sent anywhere.
Do more than mysql password hash generator — meet Chat2DB
Chat2DB is an AI-powered SQL client for Windows, macOS and Linux. Write SQL in natural language, format and optimize queries automatically, and manage MySQL, PostgreSQL, Oracle and 20+ other databases in one workspace.
How to use
- Choose Generate, then enter the user name, host and password, and pick the authentication plugin. Leave the salt empty to get a random one.
- Click Run and copy the CREATE USER or ALTER USER statement. It contains the hash and not the password, so it suits migration files and provisioning scripts. Treat it as sensitive anyway, because a weak password can be cracked from its hash.
- To audit a stored hash, choose Verify, paste the password and the value of SELECT HEX(authentication_string), and read the match result and the rounds and salt it contains.
Frequently asked questions
How does MySQL hash passwords?
It depends on the account's authentication plugin. mysql_native_password stores an asterisk followed by SHA1(SHA1(password)) in uppercase hex, with no salt, so equal passwords give equal hashes. caching_sha2_password, the default since MySQL 8.0, stores $A$005$ followed by a 20-byte random salt and a 43-character digest from 5,000 rounds of SHA-256 crypt. The 005 is the round count divided by 1,000 in hex and follows caching_sha2_password_digest_rounds. Because the salt is random, running the same password twice gives two different hashes, and both are valid.
How do I create a MySQL user with a password hash instead of plain text?
Use IDENTIFIED WITH plugin AS followed by the hash. For example: CREATE USER 'app'@'%' IDENTIFIED WITH caching_sha2_password AS 0x2441...; or, for the older plugin, IDENTIFIED WITH mysql_native_password AS '*5E84...'. The hex form suits caching_sha2_password because hashes made by the server can contain unprintable salt bytes, and it also avoids problems with $ signs in shell scripts. The statement needs no plain-text password, so the secret stays out of your scripts and shell history. The validate_password component cannot see the password in this form, so check password strength before you hash it. This page shows the result of the default policy.
Why does my mysql_native_password hash fail on MySQL 8.4 or 9?
MySQL 8.4 ships the plugin disabled, so creating or logging in to such an account returns ERROR 1524: Plugin 'mysql_native_password' is not loaded. Start the server with --mysql-native-password=ON as a short-term fix. MySQL 9.0 removed the plugin, so accounts must move to caching_sha2_password there. A native hash cannot be converted, because SHA1 and SHA-256 crypt are unrelated, so you need the plain password or a reset. Generate a new caching_sha2_password statement here and apply it. To inspect accounts by plugin, you can run SELECT user, host, plugin FROM mysql.user in Chat2DB: download it at chat2db.ai/download or open app.chat2db.ai.
