Password Management •For  ALTER USER , if you change the authentication plugin assigned to the account, the secondary password is discarded. If you change the authentication plugin and also specify  RETAIN CURRENT PASSWORD , the statement fails. •For  ALTER USER ,  DISCARD OLD PASSWORD  discards the secondary password, if one exists. The account retains only its primary password, and clients can use the account to connect to the server only with the primary password. •The  APPLICATION_PASSWORD_ADMIN  privilege is required to use the  RETAIN CURRENT PASSWORD or  DISCARD OLD PASSWORD  clause for  ALTER USER  and  SET PASSWORD  statements that apply to your own account. The privilege is required to manipulate your own secondary password because most users require only one password. •If an account is to be permitted to manipulate secondary passwords for all accounts, it should be granted the  CREATE USER  privilege rather than  APPLICATION_PASSWORD_ADMIN . 1254 mysql>  CREATE USER ’u1’@’localhost’ IDENTIFIED BY RANDOM PASSWORD, ’u2’@’%.example.com’ IDENTIFIED BY RANDOM PASSWORD, ’u3’@’%.org’ IDENTIFIED BY RANDOM PASSWORD; +------+---------------+----------------------+ | user | host | generated password | +------+---------------+----------------------+ | u1 | localhost | BA;42VpXqQ@i+y{&TDFF | | u2 | %.example.com | YX5>XRAJRP@>sn9azmD4 | | u3 | %.org | ;GfD44l,)C}PI/6)4TwZ | +------+---------------+----------------------+ mysql>  ALTER USER ’u1’@’localhost’ IDENTIFIED BY RANDOM PASSWORD, ’u2’@’%.example.com’ IDENTIFIED BY RANDOM PASSWORD; +------+---------------+----------------------+ | user | host | generated password | +------+---------------+----------------------+ | u1 | localhost | yhXBrBp.;Y6abB)e_UWr | | u2 | %.example.com | >M-vmjp9DTY6}hkp,RcC | +------+---------------+----------------------+ mysql>  SET PASSWORD FOR ’u3’@’%.org’ TO RANDOM; +------+-------+----------------------+ | user | host | generated password | +------+-------+----------------------+ | u3 | %.org | o(._oNn)d;FC<vJIDg9M | +------+-------+----------------------+ Random Password Generation For each account for which a statement generates a random password, the statement stores the password in the  mysql.user  system table, hashed appropriately for the account authentication plugin. The statement also returns the cleartext password in a row of a result set to make it available to the user or application executing the statement. The result set columns are named  user ,  host , and generated password , indicating the user name and host name values that identify the affected row in the  mysql.user  system table, and the cleartext generated password. By default, generated random passwords have a length of 20 characters. This length is controlled by the generated_random_password_length  system variable, which has a range from 5 to 255. As of MySQL 8.0.18, the  CREATE USER ,  ALTER USER , and  SET PASSWORD  statements have the capability of generating random passwords for user accounts, as an alternative to requiring explicit administrator-specified literal passwords. See the description of each statement for details about the syntax. This section describes the characteristics common to generated random passwords. Statements that modify secondary passwords require these privileges: