BYTETOOLS

MySQL Password Hash Generator

Generate MySQL PASSWORD() and OLD_PASSWORD() hashes from any password, with ready-to-run SQL. Computed locally in your browser, never uploaded.

Both MySQL hashes here are unsalted. Identical passwords always produce identical hashes, so they fall instantly to a rainbow table. They exist for restoring old dumps, seeding test fixtures and migrating legacy accounts — not for storing real credentials. Modern MySQL defaults tocaching_sha2_password, which this tool does not produce.

MySQL 4.1+ — PASSWORD() / mysql_native_password

Enter a password above to see the 41-character hash.

SHA-1 of the password, then SHA-1 of those raw 20 bytes, printed as * plus 40 uppercase hex characters. This is the value stored in mysql.user.authentication_string for accounts usingmysql_native_password.

Pre-4.1 — OLD_PASSWORD()

Enter a password above to see the 16-character legacy hash.

The original 16-hex scramble from MySQL 3.23/4.0. It carries roughly 62 bits of state and spaces and tabs in the password are ignored outright, which makes it trivially weak. MySQL 5.7.5 removed it entirely.

What is the MySQL Password Hash Generator?

The ByteTools MySQL Password Hash Generator reproduces both of MySQL's historic password formats. The modern one, used by the mysql_native_password plugin since MySQL 4.

  • MySQL 4.1+ PASSWORD() as double SHA-1 via the browser's Web Crypto
  • Legacy pre-4.1 OLD_PASSWORD() from its documented integer algorithm
  • Ready-to-paste ALTER USER and SET PASSWORD statements
  • Updates as you type — no button to press
  • Honest warnings that both formats are unsalted and weak
  • Runs entirely in your browser; the password is never transmitted

How to use the MySQL Password Hash Generator

  1. 1

    Type the password into the password box.

  2. 2

    Read the MySQL 4.1+ PASSWORD() value — the asterisk plus 40 hex characters stored for mysql_native_password accounts.

  3. 3

    Read the pre-4.1 OLD_PASSWORD() value below it if you are working with a very old server.

  4. 4

    Copy the ready-to-run SQL to set the hash directly, so the plaintext never reaches the server.

About the MySQL Password Hash Generator

The ByteTools MySQL Password Hash Generator reproduces both of MySQL's historic password formats. The modern one, used by the mysql_native_password plugin since MySQL 4.1, is SHA-1 of the password followed by SHA-1 of those raw bytes, printed as an asterisk plus 40 uppercase hex characters. The legacy pre-4.1 OLD_PASSWORD() value comes from MySQL's original 16-hex integer scramble.

It is aimed at people restoring old dumps, seeding test fixtures, writing migrations or setting a password without letting the plaintext appear in the query log. The page also gives you the ALTER USER and SET PASSWORD statements with the hash already substituted in.

Passwords are hashed 100% locally in your browser and are never uploaded, logged or stored anywhere. Be clear-eyed about what these hashes are: both are unsalted, so identical passwords always give identical values and a rainbow table defeats them instantly. They are for compatibility, not for protecting production accounts.

Frequently asked questions

How does MySQL's PASSWORD() function work?

Since MySQL 4.1 it is SHA1(SHA1(password)) — SHA-1 of the password, then SHA-1 applied again to those raw 20 bytes. The result is stored as an asterisk followed by the 40 hex digits in uppercase.

Why does MySQL 8 not have a PASSWORD() function any more?

PASSWORD() was removed in MySQL 8.0 and the default authentication plugin changed to caching_sha2_password, which is salted and iterated. This tool produces the older mysql_native_password format, which MySQL 8 still accepts if the plugin is enabled.

Is a MySQL password hash salted?

Neither of these formats is. mysql_native_password is plain double SHA-1 with no salt, so two accounts with the same password have the same stored hash. That is exactly why modern MySQL moved to caching_sha2_password.

What is OLD_PASSWORD and should I use it?

OLD_PASSWORD is MySQL 3.23/4.0's 16-hex scramble. It carries very little entropy, ignores spaces and tabs in the password outright, and was removed in MySQL 5.7.5. Use it only to read or restore genuinely ancient data.

Is it safe to type a real password here?

The hashing runs entirely in your browser and nothing is sent over the network, so the page itself is safe. The resulting hash is weak by design, though, so do not treat one of these values as protection for a real account.

Related tools