Password Management •For  ALTER USER   if you change the authentication plugin assigned to the account  the secondary password is discarded. If you change the authentication plugin and also specify  RETAIN CURRENT PASSWORD   the statement fails. •For  ALTER USER    DISCARD OLD PASSWORD  discards the secondary password  if one exists. The account retains only its primary password  and clients can use the account to connect to the server only with the primary password. •The  APPLICATION_PASSWORD_ADMIN  privilege is required to use the  RETAIN CURRENT PASSWORD or  DISCARD OLD PASSWORD  clause for  ALTER USER  and  SET PASSWORD  statements that apply to your own account. The privilege is required to manipulate your own secondary password because most users require only one password. •If an account is to be permitted to manipulate secondary passwords for all accounts  it should be granted the  CREATE USER  privilege rather than  APPLICATION_PASSWORD_ADMIN . 1254 mysql>  CREATE USER ’u1’@’localhost’ IDENTIFIED BY RANDOM PASSWORD  ’u2’@’%.example.com’ IDENTIFIED BY RANDOM PASSWORD  ’u3’@’%.org’ IDENTIFIED BY RANDOM PASSWORD; +------+---------------+----------------------+ | user | host | generated password | +------+---------------+----------------------+ | u1 | localhost | BA;42VpXqQ@i+y{&TDFF | | u2 | %.example.com | YX5>XRAJRP@>sn9azmD4 | | u3 | %.org | ;GfD44l )C}PI/6)4TwZ | +------+---------------+----------------------+ mysql>  ALTER USER ’u1’@’localhost’ IDENTIFIED BY RANDOM PASSWORD  ’u2’@’%.example.com’ IDENTIFIED BY RANDOM PASSWORD; +------+---------------+----------------------+ | user | host | generated password | +------+---------------+----------------------+ | u1 | localhost | yhXBrBp.;Y6abB)e_UWr | | u2 | %.example.com | >M-vmjp9DTY6}hkp RcC | +------+---------------+----------------------+ mysql>  SET PASSWORD FOR ’u3’@’%.org’ TO RANDOM; +------+-------+----------------------+ | user | host | generated password | +------+-------+----------------------+ | u3 | %.org | o(._oNn)d;FC<vJIDg9M | +------+-------+----------------------+ Random Password Generation For each account for which a statement generates a random password  the statement stores the password in the  mysql.user  system table  hashed appropriately for the account authentication plugin. The statement also returns the cleartext password in a row of a result set to make it available to the user or application executing the statement. The result set columns are named  user    host   and generated password   indicating the user name and host name values that identify the affected row in the  mysql.user  system table  and the cleartext generated password. By default  generated random passwords have a length of 20 characters. This length is controlled by the generated_random_password_length  system variable  which has a range from 5 to 255. As of MySQL 8.0.18  the  CREATE USER    ALTER USER   and  SET PASSWORD  statements have the capability of generating random passwords for user accounts  as an alternative to requiring explicit administrator-specified literal passwords. See the description of each statement for details about the syntax. This section describes the characteristics common to generated random passwords. Statements that modify secondary passwords require these privileges: