About the Database Password Hash Generator
Databases do not store passwords; they store hashes made in their own formats. This tool makes those hashes from a password so that you can create a user with a ready-made hash, compare a stored value, or understand how each format works. You get the MySQL and MariaDB mysql_native_password hash, the old pre-4.1 MySQL hash, the PostgreSQL MD5 form, a PostgreSQL SCRAM-SHA-256 verifier with your own salt and iteration count, and the Windows NTLM hash. Everything is worked out in your browser, so the password is never sent anywhere.
Updated September 2026
How to use the Database Password Hash Generator
- 1Type the password.
- 2For PostgreSQL MD5, enter the database user name too; it is part of the hash.
- 3For SCRAM-SHA-256, keep the random salt or paste your own salt in hex, and set the iterations (PostgreSQL defaults to 4096).
- 4Copy the hash you need, or adapt one of the SQL lines.
- 5To check an existing hash, paste it into the last box and see which format matches.
What each format is
- mysql_native_password: * plus the hex of SHA1(SHA1(password)). Used by MySQL 4.1 to 8 and MariaDB.
- OLD_PASSWORD: a 16-digit hash from MySQL before 4.1. Very weak, only found in old dumps.
- PostgreSQL MD5: md5 plus MD5(password + user name).
- SCRAM-SHA-256: a salted, slow format made with PBKDF2 and HMAC, stored as SCRAM-SHA-256$iterations:salt$StoredKey:ServerKey.
- NTLM: the Windows account format, MD4 of the password as UTF-16.
Creating a user from a hash
Sometimes you want to set a password without the plain text passing through the database console, for example in a migration script or a configuration file. Copy the hash, then use the SQL lines shown under the results. The user name and quotes are escaped for you, but always check the statement against your own server version before running it.
The Database Password Hash Generator does not contact any database. It only builds text, so nothing changes until you run the SQL yourself.
Checking a hash from a database
Paste the stored value into the check box. A match tells you which format it is and confirms that the password you typed is the one behind it. For SCRAM, copy the salt from the stored value (the part between the first colon and the next dollar sign, which is Base64) and convert it to hex, then set the same iteration count, because a different salt produces a different verifier.
Good habits
Fast hashes such as MD5 and SHA-1 are easy to brute-force, so the password behind them must be long and random. Use the Password Generator to make one and the Password Strength Checker to test it. If you just need general file checksums, the Hash Generator is the simpler tool.
Features
- MySQL and MariaDB mysql_native_password hash, checked against the well-known value for 'password'
- Old MySQL OLD_PASSWORD 16-digit hash
- PostgreSQL MD5 that includes the user name, as PostgreSQL does
- PostgreSQL SCRAM-SHA-256 verifier with editable salt and iterations
- NTLM hash for Windows accounts
- Ready SQL lines with quoted names, and a box that tells you which format a pasted hash belongs to
Frequently asked questions
What is a MySQL password hash?
For MySQL 4.1 and later, and for MariaDB, the stored value is an asterisk followed by the upper-case hex of SHA-1 applied twice to the password. You can put it in a CREATE USER statement with IDENTIFIED BY PASSWORD or, on MySQL 8, with IDENTIFIED WITH mysql_native_password AS.
Why does the PostgreSQL MD5 hash need a user name?
PostgreSQL's MD5 format hashes the password followed by the role name and adds the word md5 in front. The same password for two roles therefore gives different hashes. Enter the exact role name as it appears in the database.
Should I still use PostgreSQL MD5?
No. MD5 is weak, and newer PostgreSQL versions use SCRAM-SHA-256 by default. MD5 is shown for older servers and for checking existing data.
Why does SCRAM give a different result each time?
A SCRAM verifier includes a random salt. A new salt gives a new verifier for the same password, and all of them are valid. Keep the salt and iteration count the same if you want to reproduce a particular value.
Is mysql_native_password secure?
It has no salt and uses fast hashes, so weak passwords are easy to guess if the hash leaks. MySQL 8 prefers caching_sha2_password, which this tool does not make. Use a long random password whichever format you store.
Is my password sent anywhere?
No. All hashing runs in your browser. Even so, avoid typing a live production password into any web page; a test password is enough for learning and for checking formats.