information about internal credentials storage, see Section 6.2.15, “Password Management” . 

• auth_plugin  names an authentication plugin. The plugin name can be a quoted string literal or an unquoted name. Plugin names are stored in the plugin  column of the mysql.user  system table. 

For auth_option  syntax that does not specify an authentication plugin, the default plugin is indicated by the value of the default_authentication_plugin  system variable. For descriptions of each plugin, see Section 6.4.1, “Authentication Plugins” . 

•Credentials that are stored internally are stored in the mysql.user  system table. An ’ auth_string ’ value or RANDOM PASSWORD  specifies account credentials, either as a cleartext (unencrypted) string or hashed in the format expected by the authentication plugin associated with the account, respectively: 

•For syntax that uses BY ’ auth_string ’ , the string is cleartext and is passed to the authentication plugin for possible hashing. The result returned by the plugin is stored in the mysql.user  table. A plugin may use the value as specified, in which case no hashing occurs. 

•For syntax that uses BY RANDOM PASSWORD , MySQL generates a random password and as cleartext and passes it to the authentication plugin for possible hashing. The result returned by the plugin is stored in the mysql.user  table. A plugin may use the value as specified, in which case no hashing occurs. 

Randomly generated passwords are available as of MySQL 8.0.18 and have the characteristics described in Random Password Generation. 

•For syntax that uses AS ’ auth_string ’ , the string is assumed to be already in the format the authentication plugin requires, and is stored as is in the mysql.user  table. If a plugin requires a hashed value, the value must be already hashed in a format appropriate for the plugin; otherwise, the value cannot be used by the plugin and correct authentication of client connections does not occur. 

As of MySQL 8.0.17, a hashed string can be either a string literal or a hexadecimal value. The latter corresponds to the type of value displayed by SHOW CREATE USER  for password hashes containing unprintable characters when the print_identified_with_as_hex  system variable is enabled. 

•If an authentication plugin performs no hashing of the authentication string, the BY ’ auth_string ’ and AS ’ auth_string ’  clauses have the same effect: The authentication string is stored as is in the mysql.user  system table. 

•The REPLACE ’ current_auth_string ’  clause performs password verification and is available as of MySQL 8.0.13. If given: 

• REPLACE  specifies the account current password to be replaced, as a cleartext (unencrypted) string. 

•The clause must be given if password changes for the are required to specify the current password, as verification that the user attempting to make the change actually knows the current password. 

•The clause is optional if password changes for the account may but need not specify the current password. 

•The statement fails if the clause is given but does not match the current password, even if the clause is optional. 

• REPLACE  can be specified only when changing the account password for the current user. 

For more information about password verification by specifying the current password, see Section 6.2.15, “Password Management” . 

