Menu

MariaDB ENCODE() Function

Learn how MariaDB ENCODE() pairs with DECODE(), what it returns, and why it must not be used to protect passwords or sensitive data.

Posted on By Updated on
On this page

MariaDB ENCODE(str, pass_str) returns a binary value that can be reversed with DECODE() using the same pass string. This is a legacy encoding function, not cryptographically secure encryption. MariaDB warns against using it for password encryption. Do not rely on it to protect private or sensitive data. See the official ENCODE() documentation.

Syntax

ENCODE(str, pass_str)
  • str is the input string.
  • pass_str is the pass string used by DECODE() to recover the input.

The result is a binary string. The strength depends on the underlying random generator, so this function should be treated as legacy obfuscation rather than a security boundary.

Example

These statements show the reversible behavior with non-sensitive sample text. The session variable keeps the binary result so the exact same value is passed to DECODE():

SET @encoded_demo = ENCODE('sample text', 'demo-key');

SELECT HEX(@encoded_demo) AS encoded_hex;
SELECT DECODE(@encoded_demo, 'demo-key') AS decoded_text;

The final query returns sample text. The hexadecimal representation is for display only; it does not make ENCODE() secure.

Security note

Do not use ENCODE() to store application passwords or protect confidential values. For password storage, use a maintained password-hashing library such as Argon2id, bcrypt, or PBKDF2. For sensitive data that must be reversible, use a reviewed encryption design with proper key management; see the OWASP Cryptographic Storage Cheat Sheet.

DECODE() reverses ENCODE() when given the same pass string. It does not provide a security guarantee.