How to Change a User Password in MySQL

Galaxy Glossary

How do I change a MySQL user password?

ALTER USER or SET PASSWORD updates an existing MySQL account’s authentication string without recreating the user.

Sign up for the latest in SQL knowledge from the Galaxy Team!

Description

Why change a MySQL password with ALTER USER?

ALTER USER validates the new password against the server’s current authentication policy, writes directly to mysql.user, and eliminates the need for a manual FLUSH PRIVILEGES. It is the recommended method from MySQL 5.7.6 onward.

What is the safest syntax?

Run ALTER USER 'user'@'host' IDENTIFIED BY 'New$tr0ngP@ss'; while connected as a privileged account such as root or an admin with the ALTER USER privilege. Always quote user and host, and wrap the password in single quotes.

Example – reset an application account

ALTER USER 'app_user'@'%' IDENTIFIED BY 'S0m3$ecureP@ss!';

How do I change the root password?

Log in with an account that still has SUPER or ALTER USER rights, then run ALTER USER 'root'@'localhost' IDENTIFIED BY 'N3wR00tP@ss!';. Restarting the server is not required.

How do I verify the change worked?

Reconnect using the new password or query the mysql.user table:
SELECT user, host, authentication_string FROM mysql.user WHERE user='app_user';

What privileges do I need?

You must have the global ALTER USER privilege or possess UPDATE on mysql.*. Regular application users typically lack these rights.

Can I still use SET PASSWORD?

Yes, but SET PASSWORD is deprecated and does not enforce password policy checks in older versions. Prefer ALTER USER unless you are on MySQL 5.6 or earlier.

Best practices for secure password changes

1. Use long, random strings—at least 12 characters.
2. Store secrets in a vault, not in source code.
3. Rotate passwords on a schedule, especially for shared service accounts.

Why How to Change a User Password in MySQL is important

How to Change a User Password in MySQL Example Usage


-- Rotate password for reporting user that reads Customers and Orders
authenticate as admin;
ALTER USER 'reports'@'analytics.example.com' IDENTIFIED BY 'R3port$Q2_2024';
-- Verify
SELECT user, host FROM mysql.user WHERE user='reports';

How to Change a User Password in MySQL Syntax


ALTER USER 'user_name'@'host_name' IDENTIFIED [WITH auth_plugin] BY 'new_password' [REPLACE 'current_password'] [REQUIRE {NONE | SSL | X509 | CIPHER 'cipher' | ISSUER 'issuer' | SUBJECT 'subject'}] [PASSWORD EXPIRE [DEFAULT | NEVER | INTERVAL N DAY]];

-- Ecommerce context example
ALTER USER 'checkout_service'@'%' IDENTIFIED BY 'Ch3ck0ut#2024' REQUIRE SSL PASSWORD EXPIRE INTERVAL 180 DAY;

Common Mistakes

Using UPDATE mysql.user SET authentication_string='pwd' ... ; This bypasses password validation and requires FLUSH PRIVILEGES. Fix: use ALTER USER so MySQL handles hashing and policy checks automatically.
Forgetting to specify host—ALTER USER 'admin' IDENTIFIED BY 'pwd'; changes only 'admin'@'%'. If the account used is 'admin'@'localhost', the password remains unchanged. Always match the correct host.

Frequently Asked Questions (FAQs)

Can I change a password without root?

Yes. Any account granted the global ALTER USER privilege can modify other users, including root.

Will active sessions be disconnected?

No. Existing connections continue until they reconnect. Plan rotations during low-traffic windows.

How do I force a user to set a new password at next login?

Add PASSWORD EXPIRE to the command: ALTER USER 'sales'@'%' IDENTIFIED BY 'TempP@ss1' PASSWORD EXPIRE;

Want to learn about other SQL terms?

dbt tests

dbt tests are declarative assertions in dbt that automatically validate data quality during model builds.

dbt utils

dbt utils is a community-maintained dbt package that adds time-saving utility macros for analytics engineers, such as generating surrogate keys, safely unioning models, and automating date spines.

dbt Tutorial Glossary: Build, Test & Deploy SQL Models

dbt is an open-source framework that lets data teams transform raw warehouse tables into tested, documented, production-ready datasets using version-controlled SQL.

Trusted by top engineers on high-velocity teams

Assort Health

Curri

Rubie