Password Management •To establish a global policy such that passwords never expire, set  default_password_lifetime  to 0: [mysqld] default_password_lifetime=0 SET PERSIST default_password_lifetime = 180; SET PERSIST default_password_lifetime = 0; • default_password_lifetime  can also be set and persisted at runtime: SET PERSIST  sets the value for the running MySQL instance. It also saves the value to carry over to subsequent server restarts; see Section 13.7.6.1, “SET Syntax for Variable Assignment” . To change the value for the running MySQL instance without having it carry over to subsequent restarts, use the GLOBAL  keyword rather than  PERSIST . The global password-expiration policy applies to all accounts that have not been set to override it. To establish policy for individual accounts, use the  PASSWORD EXPIRE  option of the  CREATE USER  and ALTER USER  statements. See Section 13.7.1.3, “CREATE USER Statement” , and Section 13.7.1.1, “ALTER USER Statement” . Example account-specific statements: •Require the password to be changed every 90 days: •Disable password expiration: This expiration option overrides the global policy for all accounts named by the statement. CREATE USER ’jeffrey’@’localhost’ PASSWORD EXPIRE INTERVAL 90 DAY; ALTER USER ’jeffrey’@’localhost’ PASSWORD EXPIRE INTERVAL 90 DAY; CREATE USER ’jeffrey’@’localhost’ PASSWORD EXPIRE NEVER; ALTER USER ’jeffrey’@’localhost’ PASSWORD EXPIRE NEVER; This expiration option overrides the global policy for all accounts named by the statement. When a client successfully connects, the server determines whether the account password has expired: CREATE USER ’jeffrey’@’localhost’ PASSWORD EXPIRE DEFAULT; ALTER USER ’jeffrey’@’localhost’ PASSWORD EXPIRE DEFAULT; •Defer to the global expiration policy for all accounts named by the statement: •The server checks whether the password has been manually expired. •Otherwise, the server checks whether the password age is greater than its permitted lifetime according to the automatic password expiration policy. If so, the server considers the password expired. If the password is expired (whether manually or automatically), the server either disconnects the client or restricts the operations permitted to it (see Section 6.2.16, “Server Handling of Expired Passwords” ). Operations performed by a restricted client result in an error until the user establishes a new account password: mysql>  SELECT 1; ERROR 1820 (HY000): You must reset your password using ALTER USER statement before executing this statement. mysql>  ALTER USER USER() IDENTIFIED BY ’ password ’; Query OK, 0 rows affected (0.01 sec) 1247