Compare the hash password value in mysql.user [duplicate]

Question

Say I have a password "Foobar1234". In MySQL database (5.6), the hash value is

*59C0D3B7983F06CF32F555AD04BAC66BCF952597

I want to try this outside of MySQL database so the SQL query isn't logged. Is the hash function known? I am using the default settings.

Here is the doc: https://dev.mysql.com/doc/refman/5.6/en/password-hashing.html

Answer 1

This question was explained several times in the DBA StackExchange

• Nov 21, 2013 : Why are the passwords in MySQL (5.x) not salted? (by Michael - sqlbot)
• Dec 26, 2013 : MYSQL - Unable to change 'old_passwords' variable
• Apr 22, 2015 : Why are mysql password hashes internally saved with a star (asterisk)?

I actually learned the formula from a post from PalominoDB (later changed name to Blackbird and then was purchased by Pythian). The post was made Dec 4, 2011 entitled "Hashing Algorithm In MySQL PASSWORD()"

So if you want to execute this function yourself, it would look something like this:

SET @my_new_pass = 'WhateverIWantAsThePassword';
SET @my_new_hash = CONCAT('*',UPPER(SHA1(UNHEX(SHA1(@my_new_pass))))) MySQLPWDHASH;

This would land in the MySQL history ~/.mysql_history but not in the binary logs.