Password column from sys.user$ is null in 18c, why?

Question

Why the password column from sys.user$ is null? My version is 18c. I've made a test.

SQL> alter user harry identified by 12345678;

User altered.

SQL> select name,password from sys.user$ where name = 'HARRY';

NAME                           PASSWORD
------------------------------ ----------------------------------------
HARRY

SQL>

I'd like to use the password from harry in another user with

alter user some_user identified by values 'hash_here'

Answer 1

Check the SPARE4 column.

Quoting from https://www.experts-exchange.com/articles/855/How-Oracle-Stores-Passwords.html

11g introduces new security and the ability to support case sensitive passwords.

First, DBA_USERS no longer exposes the PASSWORD value, instead it will be NULL and you will have to go to SYS.USER$ to find the hash value.

However, if your PASSWORD_VERSIONS does not contain 10g then SYS.USER$.PASSWORD will not be reliable. The reason is the hashing algorithm populating that field doesn't support case sensitivity. So, regardless of the sensitivity setting and regardless of the upper or lower case of your password the hash will be the same. If your PASSWORD_VERSIONS is 11g only then you will need to look in the SYS.USER$.SPARE4 column and you will see a much larger hex number. This is because Oracle has switched to the SHA-1 (http://en.wikipedia.org/wiki/SHA-1) algorithm.