Password Management A  CREATE USER ,  ALTER USER , or  SET PASSWORD  statement that generates a random password for an account is written to the binary log as a  CREATE USER  or  ALTER USER  statement with an  IDENTIFIED WITH  auth_plugin  AS ’ auth_string ’ , clause, where  auth_plugin  is the account authentication plugin and  ’ auth_string ’  is the account hashed password value. If the  validate_password  component is installed, the policy that it implements has no effect on generated passwords. (The purpose of password validation is to help humans create better passwords.) As of MySQL 8.0.19, administrators can configure user accounts such that too many consecutive login failures cause temporary account locking. “Login failure”  in this context means failure of the client to provide a correct password during a connection attempt. It does not include failure to connect for reasons such as unknown user or network issues. For accounts that have dual passwords (see Dual Password Support), either account password counts as correct. The required number of login failures and the lock time are configurable per account, using the FAILED_LOGIN_ATTEMPTS  and  PASSWORD_LOCK_TIME  options of the  CREATE USER  and  ALTER USER statements. Examples: When too many consecutive login failures occur, the client receives an error that looks like this: Use the options as follows: This option indicates whether to track account login attempts that specify an incorrect password. The number  N  specifies how many consecutive incorrect passwords cause temporary account locking. This option indicates how long to lock the account after too many consecutive login attempts provide an incorrect password. The value is a number  N  to specify the number of days the account remains locked, or  UNBOUNDED  to specify that when an account enters the temporarily locked state, the duration of that state is unbounded and does not end until the account is unlocked. The conditions under which unlocking occurs are described later. Permitted values of  N  for each option are in the range from 0 to 32767. A value of 0 disables the option. Failed-login tracking and temporary account locking have these characteristics: •For failed-login tracking and temporary locking to occur for an account, its  FAILED_LOGIN_ATTEMPTS and  PASSWORD_LOCK_TIME  options both must be nonzero. •For  CREATE USER , if  FAILED_LOGIN_ATTEMPTS  or  PASSWORD_LOCK_TIME  is not specified, its implicit default value is 0 for all accounts named by the statement. This means that failed-login tracking and 1255 • PASSWORD_LOCK_TIME { N  | UNBOUNDED} • FAILED_LOGIN_ATTEMPTS  N Failed-Login Tracking and Temporary Account Locking CREATE USER ’u1’@’localhost’ IDENTIFIED BY ’ password ’ FAILED_LOGIN_ATTEMPTS 3 PASSWORD_LOCK_TIME 3; ALTER USER ’u2’@’localhost’ FAILED_LOGIN_ATTEMPTS 4 PASSWORD_LOCK_TIME UNBOUNDED; ERROR 3957 (HY000): Access denied for user  user . Account is blocked for  D  day(s) ( R  day(s) remaining) due to  N  consecutive failed logins.