What exactly does this reproduce?

MySQL 4.1 through 5.6's PASSWORD() SQL function: it computes SHA1 of the password, then SHA1 of that result again, and formats the final 20-byte digest as 40 uppercase hex characters with a literal asterisk prefixed. That's the exact string MySQL historically stored in the mysql.user table's Password column.

Is this how current MySQL actually authenticates?

No. MySQL 5.7 deprecated PASSWORD() entirely and MySQL 8.0 removed it outright, replacing this format with proper authentication plugins, caching_sha2_password (the modern default) or mysql_native_password, both of which use fundamentally different, salted schemes. This tool reproduces the older PASSWORD() format specifically because it still turns up in legacy database dumps, old mysql.user exports, and pre-5.7 systems that were never migrated.

Why double SHA1 instead of a single pass?

MySQL's own documentation describes this as intended to make the stored hash less directly comparable to a single-SHA1 hash an attacker might already have precomputed from an unrelated leak, though it provides essentially none of the protections a real password-hashing function like bcrypt does: no salt, no configurable work factor, and SHA1 itself is a fast, now-broken-for-collision-resistance hash never intended for password storage.

Does this tool send my password to a server?

No. The hash is computed entirely in your browser using @noble/hashes, an audited JavaScript library, so nothing you type here is transmitted anywhere.

MySQL Hash Calculator - Legacy PASSWORD() Function Online

Overview

Introduction

Old MySQL database dumps and mysql.user exports often contain password hashes in a very specific format: an asterisk followed by 40 uppercase hex characters, the output of MySQL's now-deprecated PASSWORD() function.

This tool reproduces that exact legacy format for any password you provide, entirely in your browser, useful for working with old dumps, migrations, or understanding a system built before MySQL 5.7.

What Is MySQL Hash Calculator?

MySQL's PASSWORD() function (available 4.1 through 5.6, deprecated in 5.7, removed in 8.0) computed a password hash as '*' + upper(hex(SHA1(SHA1(password)))), a double application of SHA1 with a distinctive asterisk-prefixed output format.

It's distinct from MySQL's modern authentication plugins (caching_sha2_password, mysql_native_password), which use different, more robust schemes; this format is specifically the older one.

How MySQL Hash Calculator Works

Your password is first encoded as UTF-8 bytes and hashed once with SHA1, producing a 20-byte intermediate digest.

That intermediate digest is hashed again with SHA1 (a second, independent pass, not extending the first), and the final 20-byte result is hex-encoded, uppercased, and prefixed with a literal asterisk to match MySQL's exact stored format.

When To Use MySQL Hash Calculator

Use this when working with a legacy MySQL dump, migrating an old mysql.user table, or needing to reproduce a pre-5.7 PASSWORD() value for compatibility or debugging.

Never use this format for any new authentication design; it lacks salting and a configurable work factor entirely, use bcrypt or Argon2 for anything you're building today.

Often used alongside MariaDB Hash Calculator, SHA-1 Hash Calculator and Hash of a Hash Calculator.

Features

Advantages

Exactly matches the historical MySQL PASSWORD() format still found in old dumps and documentation.
Simple, deterministic, and easy to verify against a known legacy value.
Useful for understanding or migrating systems built before MySQL 5.7's authentication overhaul.

Limitations

No salting: identical passwords always produce identical hashes, making precomputed lookup-table attacks effective.
No configurable work factor; SHA1 is fast, so brute-forcing short passwords is straightforward with modern hardware.
Removed from MySQL 8.0 entirely and deprecated since 5.7, so this has no bearing on current MySQL authentication behavior.

Examples

Hashing the well-known test password

Input

password

Output

*2470C0C06DEE42FD1618BB99005ADCA2EC9D1E19

A widely cited MySQL PASSWORD() test vector, useful for confirming any implementation matches the double-SHA1, asterisk-prefixed construction.

Hashing a short greeting

Input

Hello, world!

Output

*58C9B00E0F4AE70923EE73D782B7B449E4F4A480

The same double-SHA1 construction applied to a different input, useful as a second independent sanity check.

Best Practices & Notes

Best Practices

Only use this format to reproduce or understand legacy MySQL 4.1-5.6 data, never as a password-storage scheme for anything new.
If migrating an old MySQL system, plan to move users to a modern auth plugin (caching_sha2_password) rather than perpetuating this format.
For any new application, use bcrypt or Argon2, this category's dedicated Bcrypt Hash Calculator is a reasonable starting point.

Developer Notes

Implemented as SHA1(SHA1(password)) via @noble/hashes, formatted as '*' + toHex(...).toUpperCase() to match MySQL's exact PASSWORD() output. Verified against a widely cited PASSWORD('password') test vector.

MySQL Hash Calculator Use Cases

Reproducing a legacy MySQL PASSWORD() value found in an old database dump
Understanding or auditing a pre-5.7 MySQL authentication system during a migration
Cross-checking a value against MariaDB's identical inherited PASSWORD() implementation
Studying how MySQL's password hashing evolved from this format to modern auth plugins

Common Mistakes

Assuming this reflects current MySQL authentication; 5.7+ deprecated and 8.0 removed PASSWORD() entirely.
Using this or any unsalted, fast-hash format for new password storage.
Confusing this with MariaDB's PASSWORD(), which is byte-for-byte identical since MariaDB forked from MySQL 5.1 and never changed it, use either tool interchangeably for this specific format.

Tips

This exact algorithm and output format is shared with MariaDB, use the MariaDB Hash Calculator if that framing fits your context better; both tools compute the same thing.
The Hash of a Hash Calculator demonstrates a different, deliberate double-hashing construction (double SHA-256, used by Bitcoin) if you want to compare double-hashing techniques.

MySQL Hash Calculator