Authentication Plugins That causes the  sha256_password  plugin to be used by default for new accounts. As a result, it is possible to create the account and set its password without naming the plugin explicitly: CREATE USER ’sha256user’@’localhost’ IDENTIFIED BY ’ password ’; Another consequence of setting  default_authentication_plugin  to  sha256_password  is that, to use some other plugin for account creation, you must specify that plugin explicitly. For example, to use the mysql_native_password  plugin, use this statement: CREATE USER ’nativeuser’@’localhost’ IDENTIFIED WITH mysql_native_password BY ’ password ’; sha256_password  supports connections over secure transport.  sha256_password  also supports encrypted password exchange using RSA over unencrypted connections if MySQL is compiled using OpenSSL, and the MySQL server to which you wish to connect is configured to support RSA (using the RSA configuration procedure given later in this section). RSA support has these characteristics: For clients that use the  sha256_password  plugin, passwords are never exposed as cleartext when connecting to the server. How password transmission occurs depends on whether a secure connection or RSA encryption is used: 1314 •If the connection is secure, an RSA key pair is unnecessary and is not used. This applies to connections encrypted using TLS. The password is sent as cleartext but cannot be snooped because the connection is secure. •For replicas, use the  CHANGE REPLICATION SOURCE TO  statement (from MySQL 8.0.23) or CHANGE MASTER TO  statement (before MySQL 8.0.23) with the  SOURCE_PUBLIC_KEY_PATH  | MASTER_PUBLIC_KEY_PATH  option to specify the RSA public key file. For Group Replication, the group_replication_recovery_get_public_key  system variable serves the same purpose. •For programs that use the C API, call  mysql_options()  to specify the RSA public key file by passing the  MYSQL_SERVER_PUBLIC_KEY  option and the name of the file. •For these command-line clients, use the  --server-public-key-path  option to specify the RSA public key file:  mysql ,  mysqladmin ,  mysqlbinlog ,  mysqlcheck ,  mysqldump ,  mysqlimport , mysqlpump ,  mysqlshow ,  mysqlslap ,  mysqltest ,  mysql_upgrade . •For connections by accounts that authenticate with  sha256_password  and RSA public key pair-based password exchange, the server sends the RSA public key to the client as needed. However, if a copy of the public key is available on the client host, the client can use it to save a round trip in the client/server protocol: •Clients that are in possession of the RSA public key can perform RSA key pair-based password exchange with the server during the connection process, as described later. •The  Rsa_public_key  status variable displays the RSA public key value used by the sha256_password  authentication plugin. •The server uses the  sha256_password_auto_generate_rsa_keys  system variable to determine whether to automatically generate the RSA key-pair files. See Section 6.3.3, “Creating SSL and RSA Certificates and Keys” . •On the server side, two system variables name the RSA private and public key-pair files: sha256_password_private_key_path  and  sha256_password_public_key_path . The database administrator must set these variables at server startup if the key files to use have names that differ from the system variable default values.