I would like to confirm if MySQL uses SHA1 for 'PASSSWORD' hashing and why test below doesn't work:

mysql> GRANT USAGE ON *.* TO 'test'@'localhost' IDENTIFIED BY 'password';
Query OK, 0 rows affected, 1 warning (0.01 sec)

mysql> SELECT user,host,password FROM mysql.user WHERE user='test';
| user | host       | password                                  |
| test | localhost  | *2470C0C06DEE42FD1618BB99005ADCA2EC9D1E19 |
1 row in set (0.01 sec)

mysql> \q
[root@test ~]# echo -n "password" | sha1sum | awk '{print toupper($1)}'

2 Answers 2


The MySQL documentation Encryption and Compression Functions page has various functions that can be used for hashing passwords. It also clearly states that:


The PASSWORD() function is used by the authentication system in MySQL Server; you should not use it in your own applications. For that purpose, consider MD5() or SHA2() instead. Also see RFC 2195, section 2 (Challenge-Response Authentication Mechanism (CRAM)), for more information about handling passwords and authentication securely in your applications.

As for the other question, you can test at SQL-Fiddle that PASSWORD() (at least in versions 5.1, 5.5 and 5.6 that we can test at SQL-Fiddle) is implemented as applying SHA1() twice on the provided string:


Thanks should go to Rene Cannao who has digged into the source code and provided the answer in the blog post: PalominoDB.com : Hashing Algorithm in MySQL PASSWORD()

There is also this, older answer on StackOverflow which is relevant: Simulating MySql's password() encryption using .NET or MS SQL

If you want to confim with Linux CLI, just tested at Ubuntu:

ypercube@Zeus:~$    echo -n "password" | sha1sum |
      perl -ne 's/([0-9a-f]{2})/print chr hex $1/gie' | sha1sum
2470c0c06dee42fd1618bb99005adca2ec9d1e19  - 
  • Thanks for your help. Do you know why there is different has from CLI?
    – HTF
    Jul 20, 2013 at 23:29
  • What difference are you referring to? Jul 21, 2013 at 10:34
  • The hash that I've created via CLI (sha1sum) is different from the one from MySQL.
    – HTF
    Jul 21, 2013 at 15:04
  • did you try applying sha1sum twice? Jul 21, 2013 at 15:05
  1. it isn't encryption, it's hashing, which is different.

  2. MD5 and SHA-1 are both broken and vulnerable and you should not use them for password hashing. Use BCrypt.

MD5 considered harmful

SHA-1 Broken


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.