Account Management Statements •The  RETAIN CURRENT PASSWORD  and  DISCARD OLD PASSWORD  clauses implement dual-password capability and are available as of MySQL 8.0.14. Both are optional, but if given, have the following effects: • RETAIN CURRENT PASSWORD  retains an account current password as its secondary password, replacing any existing secondary password. The new password becomes the primary password, but clients can use the account to connect to the server using either the primary or secondary password. (Exception: If the new password specified by the  ALTER USER  statement is empty, the secondary password becomes empty as well, even if  RETAIN CURRENT PASSWORD  is given.) •If you specify  RETAIN CURRENT PASSWORD  for an account that has an empty primary password, the statement fails. •If an account has a secondary password and you change its primary password without specifying RETAIN CURRENT PASSWORD , the secondary password remains unchanged. •If you change the authentication plugin assigned to the account, the secondary password is discarded. If you change the authentication plugin and also specify  RETAIN CURRENT PASSWORD , the statement fails. • DISCARD OLD PASSWORD  discards the secondary password, if one exists. The account retains only its primary password, and clients can use the account to connect to the server only with the primary password. • IDENTIFIED BY ’ auth_string ’ [REPLACE ’ current_auth_string ’] [RETAIN CURRENT PASSWORD] • IDENTIFIED BY RANDOM PASSWORD [REPLACE ’ current_auth_string ’] [RETAIN CURRENT PASSWORD] • IDENTIFIED WITH  auth_plugin 2841 For more information about use of dual passwords, see Section 6.2.15, “Password Management” . ALTER USER  permits these  auth_option  syntaxes: Sets the account authentication plugin to the default plugin, passes the cleartext  ’ auth_string ’  value to the plugin for possible hashing, and stores the result in the account row in the  mysql.user  system table. The  REPLACE  clause, if given, specifies the account current password, as described previously in this section. The  RETAIN CURRENT PASSWORD  clause, if given, causes the account current password to be retained as its secondary password, as described previously in this section. Sets the account authentication plugin to the default plugin, generates a random password, passes the cleartext password value to the plugin for possible hashing, and stores the result in the account row in the  mysql.user  system table. The statement also returns the cleartext password in a result set to make it available to the user or application executing the statement. For details about the result set and characteristics of randomly generated passwords, see Random Password Generation. The  REPLACE  clause, if given, specifies the account current password, as described previously in this section. The  RETAIN CURRENT PASSWORD  clause, if given, causes the account current password to be retained as its secondary password, as described previously in this section.