Menu

MariaDB ENCRYPT() Function

Learn how MariaDB ENCRYPT() wraps the system crypt() call, handles salts, and why its result is not reversible encryption.

Posted on By Updated on
On this page

Despite its name, MariaDB’s ENCRYPT() function calls the system Unix crypt() function. It returns a crypt-format hash; it does not return reversible ciphertext, and there is no matching DECRYPT() function. MariaDB describes the function as typically used for password hashing, but it should not be used for new application password storage. The system implementation and its limits can vary. See the official ENCRYPT() documentation.

Syntax

ENCRYPT(str[, salt])
  • str is the input string.
  • salt is optional. MariaDB documents that a supplied salt must contain at least two characters; if omitted, a random salt is used.

If the underlying crypt() call is unavailable, ENCRYPT() returns NULL. Check support on the server with:

SHOW VARIABLES LIKE 'have_crypt';

The salt format and supported crypt() algorithm depend on the server’s system library. MariaDB warns that some implementations may ignore all but the first eight characters. Do not assume the result format is portable across servers.

Examples

Hash a sample string using a fixed salt:

SELECT ENCRYPT('sample text', 'ab') AS crypt_hash;

The result depends on the system crypt() implementation. With no salt argument, MariaDB selects a random salt:

SELECT ENCRYPT('sample text') AS crypt_hash;

Do not use these examples to store application passwords. For application login credentials, use a dedicated password-hashing library such as Argon2id, bcrypt, or PBKDF2; see the OWASP Password Storage Cheat Sheet.

  • SHA() and SHA1() return a general-purpose SHA-1 digest; they are not password-storage functions.
  • SHA2() returns a digest from the SHA-2 family, but a fast digest is still not a password-hashing algorithm.
  • PASSWORD() is for MariaDB Server account authentication, not application users.
  • ENCODE() and DECODE() form a separate reversible legacy encoding pair. They are not cryptographically secure.

Summary

ENCRYPT() wraps the system crypt() call and returns a one-way crypt-format hash. It cannot be decrypted with DECRYPT(). Its output can vary with the system implementation, so use it only where legacy compatibility requires it—not for protecting application passwords or confidential data.