Why the password column from sys.user$ is null? My version is 18c. I've made a test.

SQL> alter user harry identified by 12345678;

User altered.

SQL> select name,password from sys.user$ where name = 'HARRY';

NAME                           PASSWORD
------------------------------ ----------------------------------------


I'd like to use the password from harry in another user with

alter user some_user identified by values 'hash_here'

1 Answer 1


Check the SPARE4 column.

Quoting from https://www.experts-exchange.com/articles/855/How-Oracle-Stores-Passwords.html

11g introduces new security and the ability to support case sensitive passwords.

First, DBA_USERS no longer exposes the PASSWORD value, instead it will be NULL and you will have to go to SYS.USER$ to find the hash value.

However, if your PASSWORD_VERSIONS does not contain 10g then SYS.USER$.PASSWORD will not be reliable. The reason is the hashing algorithm populating that field doesn't support case sensitivity. So, regardless of the sensitivity setting and regardless of the upper or lower case of your password the hash will be the same. If your PASSWORD_VERSIONS is 11g only then you will need to look in the SYS.USER$.SPARE4 column and you will see a much larger hex number. This is because Oracle has switched to the SHA-1 (http://en.wikipedia.org/wiki/SHA-1) algorithm.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.