Account Management Statements information about internal credentials storage, see Section 6.2.15, “Password Management” . For  auth_option  syntax that does not specify an authentication plugin, the default plugin is indicated by the value of the  default_authentication_plugin  system variable. For descriptions of each plugin, see Section 6.4.1, “Authentication Plugins” . Randomly generated passwords are available as of MySQL 8.0.18 and have the characteristics described in Random Password Generation. As of MySQL 8.0.17, a hashed string can be either a string literal or a hexadecimal value. The latter corresponds to the type of value displayed by  SHOW CREATE USER  for password hashes containing unprintable characters when the  print_identified_with_as_hex  system variable is enabled. For more information about password verification by specifying the current password, see Section 6.2.15, “Password Management” . 2840 • REPLACE  can be specified only when changing the account password for the current user. •The statement fails if the clause is given but does not match the current password, even if the clause is optional. •The clause is optional if password changes for the account may but need not specify the current password. •The clause must be given if password changes for the are required to specify the current password, as verification that the user attempting to make the change actually knows the current password. • REPLACE  specifies the account current password to be replaced, as a cleartext (unencrypted) string. •The  REPLACE ’ current_auth_string ’  clause performs password verification and is available as of MySQL 8.0.13. If given: •If an authentication plugin performs no hashing of the authentication string, the  BY ’ auth_string ’ and  AS ’ auth_string ’  clauses have the same effect: The authentication string is stored as is in the mysql.user  system table. •For syntax that uses  AS ’ auth_string ’ , the string is assumed to be already in the format the authentication plugin requires, and is stored as is in the  mysql.user  table. If a plugin requires a hashed value, the value must be already hashed in a format appropriate for the plugin; otherwise, the value cannot be used by the plugin and correct authentication of client connections does not occur. •For syntax that uses  BY RANDOM PASSWORD , MySQL generates a random password and as cleartext and passes it to the authentication plugin for possible hashing. The result returned by the plugin is stored in the  mysql.user  table. A plugin may use the value as specified, in which case no hashing occurs. •For syntax that uses  BY ’ auth_string ’ , the string is cleartext and is passed to the authentication plugin for possible hashing. The result returned by the plugin is stored in the  mysql.user  table. A plugin may use the value as specified, in which case no hashing occurs. •Credentials that are stored internally are stored in the  mysql.user  system table. An  ’ auth_string value or  RANDOM PASSWORD  specifies account credentials, either as a cleartext (unencrypted) string or hashed in the format expected by the authentication plugin associated with the account, respectively: • auth_plugin  names an authentication plugin. The plugin name can be a quoted string literal or an unquoted name. Plugin names are stored in the  plugin  column of the  mysql.user  system table.