---
title: Hashing Algorithm in MySQL PASSWORD()
description: "Recently we had a question from a customer: what is the hashing algorithm implemented in PASSWORD() ? The manual doesn't give a straight answer in any of t"
---

[Blog | Pythian ](https://www.pythian.com/blog)

# [Hashing Algorithm in MySQL PASSWORD()](https://www.pythian.com/blog/hashing-algorithm-in-mysql-password-2)

 Written by [Pythian Marketing](https://www.pythian.com/blog/author/pythian-marketing) | Dec 4, 2011 5:00:00 AM

## Investigating the MySQL PASSWORD() Hashing Algorithm

Recently we had a question from a customer: what is the hashing algorithm implemented in `PASSWORD()`? The manual doesn't give a straight answer in any of these two pages:

- [MySQL Encryption Functions](https://dev.mysql.com/doc/refman/5.1/en/encryption-functions.html#function_password)
- [MySQL Password Hashing](https://dev.mysql.com/doc/refman/5.7/en/password-hashing.html)

It is enough to dig a bit more to find the solution in the [MySQL Internals Client/Server Protocol](https://forge.mysql.com/wiki/MySQL_Internals_ClientServer_Protocol#4.1_and_later) that specifies:

> "mysql.user.Password stores SHA1(SHA1(password))"

## The Discrepancy: When Initial Tests Fail to Match Documentation

Instead of blindly trusting the documentation (even if I believe it is correct), I did some tests and was confused by the first result:

```
mysql> SELECT PASSWORD("this_is_a_random_string") `pass`\G pass: *12E76A751EFA43A177049262A2EE36DA327D8E50  mysql> SELECT SHA1(SHA1("this_is_a_random_string")) `pass`\G pass: 9b653fd9fb63e1655786bfa3b3e00b0913dfc177 
```

So it looked like `SHA1(SHA1(password))` wasn't `PASSWORD(password))`, at least in this test.

## Cracking the Case: The Binary SHA1 and UNHEX() Solution

The best documentation ever is the source code, so I read the source code and understood why my previous test was incorrect: the second `SHA1()` is applied to the **binary data** returned by the first `SHA1()` and not to its hex representation. Therefore, in SQL I have to `UNHEX()` it before applying the second SHA1.

In fact:

```
mysql> SELECT SHA1(UNHEX(SHA1("this_is_a_random_string"))) `pass`\G pass: 12e76a751efa43a177049262a2ee36da327d8e50 
```

So yes, I confirmed that `mysql.user.password` stores **SHA1(SHA1(password))**. I also hope this post is useful to understand how MySQL implements `PASSWORD()`.

## MySQL Database Consulting Services

Ready to optimize your MySQL Database for the future?

 

[View full post](https://www.pythian.com/blog/hashing-algorithm-in-mysql-password-2)

```json
{
  "@context" : "http://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "Pythian Marketing"
  },
  "dateModified" : "2026-04-11T03:25:22.337Z",
  "datePublished" : "2011-12-04T05:00:00Z",
  "headline" : "Hashing Algorithm in MySQL PASSWORD()",
  "image" : {
    "@type" : "ImageObject",
    "height" : 60,
    "url" : "/hs/hsstatic/content_shared_assets/static-1.4092/img/default-amp-logo.png",
    "width" : 60
  },
  "mainEntityOfPage" : "https://www.pythian.com/blog/hashing-algorithm-in-mysql-password-2",
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "height" : 60,
      "url" : "/hs/hsstatic/content_shared_assets/static-1.4092/img/default-amp-logo.png",
      "width" : 60
    },
    "name" : "Pythian Blog"
  }
}
```