Account Management Statements cleartext passwords may be read by anyone having read access to that information. For information about the conditions under which this occurs for the server logs and how to control it, see Section 6.1.2.3, “Passwords and Logging” . For similar information about client-side logging, see Section 4.5.1.3, “mysql Client Logging” . SET PASSWORD  can be used with or without a  FOR  clause that explicitly names a user account: SET PASSWORD FOR ’jeffrey’@’localhost’ = ’ auth_string ’; SET PASSWORD = ’ auth_string ’; Any client who connects to the server using a nonanonymous account can change the password for that account. (In particular, you can change your own password.) To see which account the server authenticated you as, invoke the  CURRENT_USER()  function: SELECT CURRENT_USER(); If a  FOR  user  clause is given, the account name uses the format described in Section 6.2.4, “Specifying Account Names” . For example: SET PASSWORD FOR ’bob’@’%.example.org’ = ’ auth_string ’; The host name part of the account name, if omitted, defaults to  ’%’ . SET PASSWORD  interprets the string as a cleartext string, passes it to the authentication plugin associated with the account, and stores the result returned by the plugin in the account row in the  mysql.user system table. (The plugin is given the opportunity to hash the value into the encryption format it expects. The plugin may use the value as specified, in which case no hashing occurs.) Setting the password for a named account (with a  FOR  clause) requires the  UPDATE  privilege for the  mysql system schema. Setting the password for yourself (for a nonanonymous account with no  FOR  clause) requires no special privileges. Statements that modify secondary passwords require these privileges: When the  read_only  system variable is enabled,  SET PASSWORD  requires the  CONNECTION_ADMIN privilege (or the deprecated  SUPER  privilege), in addition to any other required privileges. For additional information about setting passwords and authentication plugins, see Section 6.2.14, “Assigning Account Passwords” , and Section 6.2.17, “Pluggable Authentication” . 2881 13.7.1.11 SET ROLE Statement •With a  FOR  user  clause, the statement sets the password for the named account, which must exist: •With no  FOR  user  clause, the statement sets the password for the current user: •The  APPLICATION_PASSWORD_ADMIN  privilege is required to use the  RETAIN CURRENT PASSWORD clause for  SET PASSWORD  statements that apply to your own account. The privilege is required to manipulate your own secondary password because most users require only one password. •If an account is to be permitted to manipulate secondary passwords for all accounts, it should be granted the  CREATE USER  privilege rather than  APPLICATION_PASSWORD_ADMIN . SET ROLE { DEFAULT | NONE | ALL