<div id="docs-body">
 <div class="section">
  <div class="titlepage">
   <div>
    <div>
     <h4 class="title">
      <a name="set-password">
      </a>
      15.7.1.10 SET PASSWORD Statement
     </h4>
    </div>
   </div>
  </div>
  <a class="indexterm" name="idm46045172989584">
  </a>
  <a class="indexterm" name="idm46045172988512">
  </a>
  <a class="indexterm" name="idm46045172987024">
  </a>
  <div class="copytoclipboard-wrapper">
   <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa58412185"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">SET</span> <span class="token keyword">PASSWORD</span> <span class="token punctuation">[</span><span class="token keyword">FOR</span> <span class="token keyword"><em class="replaceable">user</em></span><span class="token punctuation">]</span> <em class="replaceable">auth_option</em>
    <span class="token punctuation">[</span><span class="token keyword">REPLACE</span> <span class="token string">'<em class="replaceable">current_auth_string</em>'</span><span class="token punctuation">]</span>
    <span class="token punctuation">[</span><span class="token keyword">RETAIN</span> <span class="token keyword">CURRENT</span> <span class="token keyword">PASSWORD</span><span class="token punctuation">]</span>

<em class="replaceable">auth_option</em>: {
    <span class="token operator">=</span> <span class="token string">'<em class="replaceable">auth_string</em>'</span>
  <span class="token operator">|</span> <span class="token keyword">TO</span> <span class="token keyword">RANDOM</span>
}</code></pre>
  </div>
  <p>
   The
   <a class="link" href="set-password.html" title="15.7.1.10 SET PASSWORD Statement">
    <code class="literal">
     SET PASSWORD
    </code>
   </a>
   statement
        assigns a password to a MySQL user account. The password may be
        either explicitly specified in the statement or randomly
        generated by MySQL. The statement may also include a
        password-verification clause that specifies the account current
        password to be replaced, and a clause that manages whether an
        account has a secondary password.
   <code class="literal">
    '
    <em class="replaceable">
     <code>
      auth_string
     </code>
    </em>
    '
   </code>
   and
   <code class="literal">
    '
    <em class="replaceable">
     <code>
      current_auth_string
     </code>
    </em>
    '
   </code>
   each represent a cleartext (unencrypted) password.
  </p>
  <div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
   <div class="admon-title">
    Note
   </div>
   <p>
    Rather than using
    <a class="link" href="set-password.html" title="15.7.1.10 SET PASSWORD Statement">
     <code class="literal">
      SET PASSWORD
     </code>
    </a>
    to assign passwords,
    <a class="link" href="alter-user.html" title="15.7.1.1 ALTER USER Statement">
     <code class="literal">
      ALTER USER
     </code>
    </a>
    is the preferred statement for account alterations, including
          assigning passwords. For example:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting one-line language-sql"><div class="docs-select-all right" id="sa49293453"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">ALTER</span> <span class="token keyword">USER</span> <span class="token keyword"><em class="replaceable">user</em></span> <span class="token keyword">IDENTIFIED</span> <span class="token keyword">BY</span> <span class="token string">'<em class="replaceable">auth_string</em>'</span><span class="token punctuation">;</span></code></pre>
   </div>
  </div>
  <div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
   <div class="admon-title">
    Note
   </div>
   <p>
    Clauses for random password generation, password verification,
          and secondary passwords apply only to accounts that use an
          authentication plugin that stores credentials internally to
          MySQL. For accounts that use a plugin that performs
          authentication against a credentials system that is external
          to MySQL, password management must be handled externally
          against that system as well. For more information about
          internal credentials storage, see
    <a class="xref" href="password-management.html" title="8.2.15 Password Management">
     Section 8.2.15, “Password Management”
    </a>
    .
   </p>
  </div>
  <p>
   The
   <code class="literal">
    REPLACE
        '
    <em class="replaceable">
     <code>
      current_auth_string
     </code>
    </em>
    '
   </code>
   clause performs password verification. If given:
  </p>
  <div class="itemizedlist">
   <ul class="itemizedlist" style="list-style-type: disc; ">
    <li class="listitem">
     <p>
      <code class="literal">
       REPLACE
      </code>
      specifies the account current
            password to be replaced, as a cleartext (unencrypted)
            string.
     </p>
    </li>
    <li class="listitem">
     <p>
      The clause must be given if password changes for the account
            are required to specify the current password, as
            verification that the user attempting to make the change
            actually knows the current password.
     </p>
    </li>
    <li class="listitem">
     <p>
      The clause is optional if password changes for the account
            may but need not specify the current password.
     </p>
    </li>
    <li class="listitem">
     <p>
      The statement fails if the clause is given but does not
            match the current password, even if the clause is optional.
     </p>
    </li>
    <li class="listitem">
     <p>
      <code class="literal">
       REPLACE
      </code>
      can be specified only when
            changing the account password for the current user.
     </p>
    </li>
   </ul>
  </div>
  <p>
   For more information about password verification by specifying
        the current password, see
   <a class="xref" href="password-management.html" title="8.2.15 Password Management">
    Section 8.2.15, “Password Management”
   </a>
   .
  </p>
  <p>
   The
   <code class="literal">
    RETAIN CURRENT PASSWORD
   </code>
   clause implements
        dual-password capability. If given:
  </p>
  <div class="itemizedlist">
   <ul class="itemizedlist" style="list-style-type: disc; ">
    <li class="listitem">
     <p>
      <code class="literal">
       RETAIN CURRENT PASSWORD
      </code>
      retains an
            account current password as its secondary password,
            replacing any existing secondary password. The new password
            becomes the primary password, but clients can use the
            account to connect to the server using either the primary or
            secondary password. (Exception: If the new password
            specified by the
      <a class="link" href="set-password.html" title="15.7.1.10 SET PASSWORD Statement">
       <code class="literal">
        SET PASSWORD
       </code>
      </a>
      statement is empty, the secondary password becomes empty as
            well, even if
      <code class="literal">
       RETAIN CURRENT PASSWORD
      </code>
      is
            given.)
     </p>
    </li>
    <li class="listitem">
     <p>
      If you specify
      <code class="literal">
       RETAIN CURRENT PASSWORD
      </code>
      for an account that has an empty primary password, the
            statement fails.
     </p>
    </li>
    <li class="listitem">
     <p>
      If an account has a secondary password and you change its
            primary password without specifying
      <code class="literal">
       RETAIN CURRENT
            PASSWORD
      </code>
      , the secondary password remains
            unchanged.
     </p>
    </li>
   </ul>
  </div>
  <p>
   For more information about use of dual passwords, see
   <a class="xref" href="password-management.html" title="8.2.15 Password Management">
    Section 8.2.15, “Password Management”
   </a>
   .
  </p>
  <p>
   <a class="link" href="set-password.html" title="15.7.1.10 SET PASSWORD Statement">
    <code class="literal">
     SET PASSWORD
    </code>
   </a>
   permits these
   <em class="replaceable">
    <code>
     auth_option
    </code>
   </em>
   syntaxes:
  </p>
  <div class="itemizedlist">
   <ul class="itemizedlist" style="list-style-type: disc; ">
    <li class="listitem">
     <p>
      <code class="literal">
       =
            '
       <em class="replaceable">
        <code>
         auth_string
        </code>
       </em>
       '
      </code>
     </p>
     <p>
      Assigns the account the given literal password.
     </p>
    </li>
    <li class="listitem">
     <p>
      <code class="literal">
       TO RANDOM
      </code>
     </p>
     <p>
      Assigns the account a password randomly generated by MySQL.
            The statement also returns the cleartext password in a
            result set to make it available to the user or application
            executing the statement.
     </p>
     <p>
      For details about the result set and characteristics of
            randomly generated passwords, see
      <a class="xref" href="password-management.html#random-password-generation" title="Random Password Generation">
       Random Password Generation
      </a>
      .
     </p>
    </li>
   </ul>
  </div>
  <div class="important" style="margin-left: 0.5in; margin-right: 0.5in;">
   <div class="admon-title">
    Important
   </div>
   <p>
    Under some circumstances,
    <a class="link" href="set-password.html" title="15.7.1.10 SET PASSWORD Statement">
     <code class="literal">
      SET
          PASSWORD
     </code>
    </a>
    may be recorded in server logs or on the
          client side in a history file such as
    <code class="filename">
     ~/.mysql_history
    </code>
    , which means that
          cleartext passwords may be read by anyone having read access
          to that information. For information about the conditions
          under which this occurs for the server logs and how to control
          it, see
    <a class="xref" href="password-logging.html" title="8.1.2.3 Passwords and Logging">
     Section 8.1.2.3, “Passwords and Logging”
    </a>
    . For similar
          information about client-side logging, see
    <a class="xref" href="mysql-logging.html" title="6.5.1.3 mysql Client Logging">
     Section 6.5.1.3, “mysql Client Logging”
    </a>
    .
   </p>
  </div>
  <p>
   <a class="link" href="set-password.html" title="15.7.1.10 SET PASSWORD Statement">
    <code class="literal">
     SET PASSWORD
    </code>
   </a>
   can be used with or
        without a
   <code class="literal">
    FOR
   </code>
   clause that explicitly names a
        user account:
  </p>
  <div class="itemizedlist">
   <ul class="itemizedlist" style="list-style-type: disc; ">
    <li class="listitem">
     <p>
      With a
      <code class="literal">
       FOR
       <em class="replaceable">
        <code>
         user
        </code>
       </em>
      </code>
      clause, the
            statement sets the password for the named account, which
            must exist:
     </p>
     <div class="copytoclipboard-wrapper">
      <pre class="programlisting one-line language-sql"><div class="docs-select-all right" id="sa34770843"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">SET</span> <span class="token keyword">PASSWORD</span> <span class="token keyword">FOR</span> <span class="token string">'jeffrey'</span>@<span class="token string">'localhost'</span> <span class="token operator">=</span> <span class="token string">'<em class="replaceable">auth_string</em>'</span><span class="token punctuation">;</span></code></pre>
     </div>
    </li>
    <li class="listitem">
     <p>
      With no
      <code class="literal">
       FOR
       <em class="replaceable">
        <code>
         user
        </code>
       </em>
      </code>
      clause, the
            statement sets the password for the current user:
     </p>
     <div class="copytoclipboard-wrapper">
      <pre class="programlisting one-line language-sql"><div class="docs-select-all right" id="sa12815858"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">SET</span> <span class="token keyword">PASSWORD</span> <span class="token operator">=</span> <span class="token string">'<em class="replaceable">auth_string</em>'</span><span class="token punctuation">;</span></code></pre>
     </div>
     <p>
      Any client who connects to the server using a nonanonymous
            account can change the password for that account. (In
            particular, you can change your own password.) To see which
            account the server authenticated you as, invoke the
      <a class="link" href="information-functions.html#function_current-user">
       <code class="literal">
        CURRENT_USER()
       </code>
      </a>
      function:
     </p>
     <div class="copytoclipboard-wrapper">
      <pre class="programlisting one-line language-sql"><div class="docs-select-all right" id="sa22076336"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">SELECT</span> <span class="token function">CURRENT_USER</span><span class="token punctuation">(</span><span class="token punctuation">)</span><span class="token punctuation">;</span></code></pre>
     </div>
    </li>
   </ul>
  </div>
  <p>
   If a
   <code class="literal">
    FOR
    <em class="replaceable">
     <code>
      user
     </code>
    </em>
   </code>
   clause is given, the account name uses the format described in
   <a class="xref" href="account-names.html" title="8.2.4 Specifying Account Names">
    Section 8.2.4, “Specifying Account Names”
   </a>
   . For example:
  </p>
  <div class="copytoclipboard-wrapper">
   <pre class="programlisting one-line language-sql"><div class="docs-select-all right" id="sa31058125"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">SET</span> <span class="token keyword">PASSWORD</span> <span class="token keyword">FOR</span> <span class="token string">'bob'</span>@<span class="token string">'%.example.org'</span> <span class="token operator">=</span> <span class="token string">'<em class="replaceable">auth_string</em>'</span><span class="token punctuation">;</span></code></pre>
  </div>
  <p>
   The host name part of the account name, if omitted, defaults to
   <code class="literal">
    '%'
   </code>
   .
  </p>
  <p>
   <a class="link" href="set-password.html" title="15.7.1.10 SET PASSWORD Statement">
    <code class="literal">
     SET PASSWORD
    </code>
   </a>
   interprets the
        string as a cleartext string, passes it to the authentication
        plugin associated with the account, and stores the result
        returned by the plugin in the account row in the
   <code class="literal">
    mysql.user
   </code>
   system table. (The plugin is given
        the opportunity to hash the value into the encryption format it
        expects. The plugin may use the value as specified, in which
        case no hashing occurs.)
  </p>
  <p>
   Setting the password for a named account (with a
   <code class="literal">
    FOR
   </code>
   clause) requires the
   <a class="link" href="privileges-provided.html#priv_update">
    <code class="literal">
     UPDATE
    </code>
   </a>
   privilege for the
   <code class="literal">
    mysql
   </code>
   system schema. Setting the password for
        yourself (for a nonanonymous account with no
   <code class="literal">
    FOR
   </code>
   clause) requires no special privileges.
  </p>
  <p>
   Statements that modify secondary passwords require these
        privileges:
  </p>
  <div class="itemizedlist">
   <ul class="itemizedlist" style="list-style-type: disc; ">
    <li class="listitem">
     <p>
      The
      <a class="link" href="privileges-provided.html#priv_application-password-admin">
       <code class="literal">
        APPLICATION_PASSWORD_ADMIN
       </code>
      </a>
      privilege is required to use the
      <code class="literal">
       RETAIN CURRENT
            PASSWORD
      </code>
      clause for
      <a class="link" href="set-password.html" title="15.7.1.10 SET PASSWORD Statement">
       <code class="literal">
        SET
            PASSWORD
       </code>
      </a>
      statements that apply to your own
            account. The privilege is required to manipulate your own
            secondary password because most users require only one
            password.
     </p>
    </li>
    <li class="listitem">
     <p>
      If an account is to be permitted to manipulate secondary
            passwords for all accounts, it should be granted the
      <a class="link" href="privileges-provided.html#priv_create-user">
       <code class="literal">
        CREATE USER
       </code>
      </a>
      privilege rather
            than
      <a class="link" href="privileges-provided.html#priv_application-password-admin">
       <code class="literal">
        APPLICATION_PASSWORD_ADMIN
       </code>
      </a>
      .
     </p>
    </li>
   </ul>
  </div>
  <p>
   When the
   <a class="link" href="server-system-variables.html#sysvar_read_only">
    <code class="literal">
     read_only
    </code>
   </a>
   system
        variable is enabled,
   <a class="link" href="set-password.html" title="15.7.1.10 SET PASSWORD Statement">
    <code class="literal">
     SET PASSWORD
    </code>
   </a>
   requires the
   <a class="link" href="privileges-provided.html#priv_connection-admin">
    <code class="literal">
     CONNECTION_ADMIN
    </code>
   </a>
   privilege (or the deprecated
   <a class="link" href="privileges-provided.html#priv_super">
    <code class="literal">
     SUPER
    </code>
   </a>
   privilege), in addition to
        any other required privileges.
  </p>
  <p>
   For additional information about setting passwords and
        authentication plugins, see
   <a class="xref" href="assigning-passwords.html" title="8.2.14 Assigning Account Passwords">
    Section 8.2.14, “Assigning Account Passwords”
   </a>
   , and
   <a class="xref" href="pluggable-authentication.html" title="8.2.17 Pluggable Authentication">
    Section 8.2.17, “Pluggable Authentication”
   </a>
   .
  </p>
 </div>
 <br/>
</div>
