MariaDB PASSWORD() Function
Learn what MariaDB PASSWORD() does, why it is limited to MariaDB server account authentication, and why it is not an application password hash.
On this page
MariaDB’s PASSWORD(str) function calculates a password hash for use by MariaDB Server authentication. MariaDB explicitly says it is not intended for application password storage. Its result depends on MariaDB authentication settings; do not treat it as a stable application hash format. See the official PASSWORD() documentation.
Syntax
PASSWORD(str)
str is the input string. The function returns a hash string. MariaDB documents an empty-string result when str is NULL:
SELECT PASSWORD('example');
SELECT PASSWORD(NULL);
The returned value is server-specific. Do not copy a hash shown on one installation into an application or assume it matches another account’s authentication plugin.
Use it with MariaDB account management
Use MariaDB account-management statements to create or change database accounts. For accounts whose authentication plugin supports it, SET PASSWORD can use PASSWORD():
SET PASSWORD FOR 'demo_user'@'localhost' =
PASSWORD('replace-with-a-strong-unique-password');
Replace the sample account and password with your own values. Check the documentation for the authentication plugin used by the account; plugins differ in how they store credentials. See MariaDB’s SET PASSWORD documentation.
Do not use PASSWORD() for application logins
Do not store PASSWORD() output in an application’s users table or use it to verify application passwords. MariaDB’s function is for MariaDB Server authentication, and ordinary fast hashes are not designed to withstand offline password guessing.
For application users, use a maintained password-hashing library that supports an adaptive password hash such as Argon2id, bcrypt, or PBKDF2. Follow the language or framework’s current password-storage guidance; see the OWASP Password Storage Cheat Sheet.
Summary
PASSWORD() is a MariaDB account-authentication helper, not a general-purpose password-storage API and not an alias for ENCRYPT(). Use MariaDB’s account-management statements for database accounts and an application password-hashing library for application users.