<div id="docs-body">
 <div class="section">
  <div class="titlepage">
   <div>
    <div>
     <h3 class="title">
      <a name="user-names">
      </a>
      8.2.1 Account User Names and Passwords
     </h3>
    </div>
   </div>
  </div>
  <a class="indexterm" name="idm46045252290896">
  </a>
  <a class="indexterm" name="idm46045252289440">
  </a>
  <p>
   MySQL stores accounts in the
   <code class="literal">
    user
   </code>
   table of the
   <code class="literal">
    mysql
   </code>
   system database. An account is defined in
      terms of a user name and the client host or hosts from which the
      user can connect to the server. For information about account
      representation in the
   <code class="literal">
    user
   </code>
   table, see
   <a class="xref" href="grant-tables.html" title="8.2.3 Grant Tables">
    Section 8.2.3, “Grant Tables”
   </a>
   .
  </p>
  <p>
   An account may also have authentication credentials such as a
      password. The credentials are handled by the account
      authentication plugin. MySQL supports multiple authentication
      plugins. Some of them use built-in authentication methods, whereas
      others enable authentication using external authentication
      methods. See
   <a class="xref" href="pluggable-authentication.html" title="8.2.17 Pluggable Authentication">
    Section 8.2.17, “Pluggable Authentication”
   </a>
   .
  </p>
  <p>
   There are several distinctions between the way user names and
      passwords are used by MySQL and your operating system:
  </p>
  <div class="itemizedlist">
   <ul class="itemizedlist" style="list-style-type: disc; ">
    <li class="listitem">
     <p>
      User names, as used by MySQL for authentication purposes, have
          nothing to do with user names (login names) as used by Windows
          or Unix. On Unix, most MySQL clients by default try to log in
          using the current Unix user name as the MySQL user name, but
          that is for convenience only. The default can be overridden
          easily, because client programs permit any user name to be
          specified with a
      <code class="option">
       -u
      </code>
      or
      <code class="option">
       --user
      </code>
      option. This means that anyone can
          attempt to connect to the server using any user name, so you
          cannot make a database secure in any way unless all MySQL
          accounts have passwords. Anyone who specifies a user name for
          an account that has no password can connect successfully to
          the server.
     </p>
    </li>
    <li class="listitem">
     <p>
      MySQL user names are up to 32 characters long. Operating
          system user names may have a different maximum length.
     </p>
     <div class="warning" style="margin-left: 0.5in; margin-right: 0.5in;">
      <div class="admon-title">
       Warning
      </div>
      <p>
       The MySQL user name length limit is hardcoded in MySQL
            servers and clients, and trying to circumvent it by
            modifying the definitions of the tables in the
       <code class="literal">
        mysql
       </code>
       database
       <span class="emphasis">
        <em>
         does not
            work
        </em>
       </span>
       .
      </p>
      <p>
       You should never alter the structure of tables in the
       <code class="literal">
        mysql
       </code>
       database in any manner whatsoever
            except by means of the procedure that is described in
       <a class="xref" href="upgrading.html" title="Chapter 3 Upgrading MySQL">
        Chapter 3,
        <i>
         Upgrading MySQL
        </i>
       </a>
       . Attempting to redefine the
            MySQL system tables in any other fashion results in
            undefined and unsupported behavior. The server is free to
            ignore rows that become malformed as a result of such
            modifications.
      </p>
     </div>
    </li>
    <li class="listitem">
     <p>
      To authenticate client connections for accounts that use
          built-in authentication methods, the server uses passwords
          stored in the
      <code class="literal">
       user
      </code>
      table. These passwords
          are distinct from passwords for logging in to your operating
          system. There is no necessary connection between the
      <span class="quote">
       “
       <span class="quote">
        external
       </span>
       ”
      </span>
      password you use to log in to a
          Windows or Unix machine and the password you use to access the
          MySQL server on that machine.
     </p>
     <p>
      If the server authenticates a client using some other plugin,
          the authentication method that the plugin implements may or
          may not use a password stored in the
      <code class="literal">
       user
      </code>
      table. In this case, it is possible that an external password
          is also used to authenticate to the MySQL server.
     </p>
    </li>
    <li class="listitem">
     <p>
      Passwords stored in the
      <code class="literal">
       user
      </code>
      table are
          encrypted using plugin-specific algorithms.
     </p>
    </li>
    <li class="listitem">
     <p>
      If the user name and password contain only ASCII characters,
          it is possible to connect to the server regardless of
          character set settings. To enable connections when the user
          name or password contain non-ASCII characters, client
          applications should call the
      <a class="ulink" href="/doc/c-api/8.4/en/mysql-options.html" target="_top">
       <code class="literal">
        mysql_options()
       </code>
      </a>
      C API function
          with the
      <code class="literal">
       MYSQL_SET_CHARSET_NAME
      </code>
      option and
          appropriate character set name as arguments. This causes
          authentication to take place using the specified character
          set. Otherwise, authentication fails unless the server default
          character set is the same as the encoding in the
          authentication defaults.
     </p>
     <p>
      Standard MySQL client programs support a
      <code class="option">
       --default-character-set
      </code>
      option that causes
      <a class="ulink" href="/doc/c-api/8.4/en/mysql-options.html" target="_top">
       <code class="literal">
        mysql_options()
       </code>
      </a>
      to be called
          as just described. In addition, character set autodetection is
          supported as described in
      <a class="xref" href="charset-connection.html" title="12.4 Connection Character Sets and Collations">
       Section 12.4, “Connection Character Sets and Collations”
      </a>
      . For programs that use a
          connector that is not based on the C API, the connector may
          provide an equivalent to
      <a class="ulink" href="/doc/c-api/8.4/en/mysql-options.html" target="_top">
       <code class="literal">
        mysql_options()
       </code>
      </a>
      that can be
          used instead. Check the connector documentation.
     </p>
     <p>
      The preceding notes do not apply for
      <code class="literal">
       ucs2
      </code>
      ,
      <code class="literal">
       utf16
      </code>
      , and
      <code class="literal">
       utf32
      </code>
      , which
          are not permitted as client character sets.
     </p>
    </li>
   </ul>
  </div>
  <p>
   The MySQL installation process populates the grant tables with an
      initial
   <code class="literal">
    root
   </code>
   account, as described in
   <a class="xref" href="default-privileges.html" title="2.9.4 Securing the Initial MySQL Account">
    Section 2.9.4, “Securing the Initial MySQL Account”
   </a>
   , which also discusses how to
      assign a password to it. Thereafter, you normally set up, modify,
      and remove MySQL accounts using statements such as
   <a class="link" href="create-user.html" title="15.7.1.3 CREATE USER Statement">
    <code class="literal">
     CREATE USER
    </code>
   </a>
   ,
   <a class="link" href="drop-user.html" title="15.7.1.5 DROP USER Statement">
    <code class="literal">
     DROP USER
    </code>
   </a>
   ,
   <a class="link" href="grant.html" title="15.7.1.6 GRANT Statement">
    <code class="literal">
     GRANT
    </code>
   </a>
   , and
   <a class="link" href="revoke.html" title="15.7.1.8 REVOKE Statement">
    <code class="literal">
     REVOKE
    </code>
   </a>
   . See
   <a class="xref" href="creating-accounts.html" title="8.2.8 Adding Accounts, Assigning Privileges, and Dropping Accounts">
    Section 8.2.8, “Adding Accounts, Assigning Privileges, and Dropping Accounts”
   </a>
   , and
   <a class="xref" href="account-management-statements.html" title="15.7.1 Account Management Statements">
    Section 15.7.1, “Account Management Statements”
   </a>
   .
  </p>
  <p>
   To connect to a MySQL server with a command-line client, specify
      user name and password options as necessary for the account that
      you want to use:
  </p>
  <div class="copytoclipboard-wrapper">
   <pre class="programlisting one-line language-terminal"><div class="docs-select-all right" id="sa55316859"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-terminal"><span class="token prompt">$&gt; </span><span class="token command">mysql</span> <span class="token constant">--user</span><span class="token attr-value"><span class="token punctuation">=</span>finley</span> <span class="token property">--password</span> <em class="replaceable">db_name</em></code></pre>
  </div>
  <p>
   If you prefer short options, the command looks like this:
  </p>
  <div class="copytoclipboard-wrapper">
   <pre class="programlisting one-line language-terminal"><div class="docs-select-all right" id="sa23346708"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-terminal"><span class="token prompt">$&gt; </span><span class="token command">mysql</span> <span class="token property">-u</span> finley <span class="token property">-p</span> <em class="replaceable">db_name</em></code></pre>
  </div>
  <p>
   If you omit the password value following the
   <a class="link" href="connection-options.html#option_general_password">
    <code class="option">
     --password
    </code>
   </a>
   or
   <code class="option">
    -p
   </code>
   option on the command line (as just shown), the client prompts for
      one. Alternatively, the password can be specified on the command
      line:
  </p>
  <div class="copytoclipboard-wrapper">
   <pre class="programlisting language-terminal"><div class="docs-select-all right" id="sa68341090"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-terminal"><span class="token prompt">$&gt; </span><span class="token command">mysql</span> <span class="token constant">--user</span><span class="token attr-value"><span class="token punctuation">=</span>finley</span> <span class="token constant">--password</span><span class="token attr-value"><span class="token punctuation">=</span><em class="replaceable">password</em></span> <em class="replaceable">db_name</em>
<span class="token prompt">$&gt; </span><span class="token command">mysql</span> <span class="token property">-u</span> finley <span class="token property">-p<em class="replaceable">password</em></span> <em class="replaceable">db_name</em></code></pre>
  </div>
  <p>
   If you use the
   <code class="option">
    -p
   </code>
   option, there must be
   <span class="emphasis">
    <em>
     no space
    </em>
   </span>
   between
   <code class="option">
    -p
   </code>
   and the
      following password value.
  </p>
  <p>
   Specifying a password on the command line should be considered
      insecure. See
   <a class="xref" href="password-security-user.html" title="8.1.2.1 End-User Guidelines for Password Security">
    Section 8.1.2.1, “End-User Guidelines for Password Security”
   </a>
   . To avoid
      giving the password on the command line, use an option file or a
      login path file. See
   <a class="xref" href="option-files.html" title="6.2.2.2 Using Option Files">
    Section 6.2.2.2, “Using Option Files”
   </a>
   , and
   <a class="xref" href="mysql-config-editor.html" title="6.6.7 mysql_config_editor — MySQL Configuration Utility">
    Section 6.6.7, “mysql_config_editor — MySQL Configuration Utility”
   </a>
   .
  </p>
  <p>
   For additional information about specifying user names, passwords,
      and other connection parameters, see
   <a class="xref" href="connecting.html" title="6.2.4 Connecting to the MySQL Server Using Command Options">
    Section 6.2.4, “Connecting to the MySQL Server Using Command Options”
   </a>
   .
  </p>
 </div>
 <br/>
</div>
