Password Management The  REPLACE  clause works like this: As of MySQL 8.0.14, user accounts are permitted to have dual passwords, designated as primary and secondary passwords. Dual-password capability makes it possible to seamlessly perform credential changes in scenarios like this: Consider how a credential change must be performed in the preceding type of scenario when an account is permitted only a single password. In this case, there must be close cooperation in the timing of when the account password change is made and propagated throughout all servers, and when all applications that use the account are updated to use the new password. This process may involve downtime during which servers or applications are unavailable. With dual passwords, credential changes can be made more easily, in phases, without requiring close cooperation, and without downtime: 1252 1. For each affected account, establish a new primary password on the servers, retaining the current password as the secondary password. This enables servers to recognize either the primary or •Periodic credential changes must be made to the account or accounts used by the applications to connect to the servers. •Multiple applications connect to different MySQL servers. •A system has a large number of MySQL servers, possibly involving replication. • REPLACE  is omitted from the binary log to avoid writing cleartext passwords to it. • REPLACE  can be specified only when changing the account password for the current user. (This means that in the examples just shown, the statements that explicitly name the account for  jeffrey  fail unless the current user is  jeffrey .) This is true even if the change is attempted for another user by a privileged user; however, such a user can change any password without specifying  REPLACE . •If  REPLACE  is specified, it must specify the correct current password, or an error occurs. This is true even if  REPLACE  is optional. • REPLACE  is optional if password changes for the account may but need not specify the current password. • REPLACE  must be given if password changes for the account are required to specify the current password, as verification that the user attempting to make the change actually knows the current password. •Change a named user’s authentication plugin and password: •Change a named user’s password: ALTER USER ’jeffrey’@’localhost’ IDENTIFIED BY ’ auth_string ’ REPLACE ’ current_auth_string ’; ALTER USER ’jeffrey’@’localhost’ IDENTIFIED WITH caching_sha2_password BY ’ auth_string ’ REPLACE ’ current_auth_string ’; Dual Password Support ALTER USER USER() IDENTIFIED BY ’ auth_string ’ REPLACE ’ current_auth_string ’;