Why does MariaDB use the exact same hash format as MySQL?

History: MariaDB began in 2009 as a fork of MySQL 5.1, created by Michael Widenius (one of MySQL's original authors) in response to Oracle's acquisition of MySQL. It inherited PASSWORD() unchanged at the fork point, and since backward compatibility with existing MySQL-derived tooling and data has always been a MariaDB design priority, that legacy format was never redesigned even as MariaDB and MySQL diverged in many other areas.

Does MariaDB still use this format by default?

No, modern MariaDB installations default to newer authentication plugins like ed25519 or unix_socket, and support PAM and other pluggable auth methods. This PASSWORD()-format hash persists mainly in older installations, legacy dumps, and specific compatibility scenarios where the classic format is still expected.

Is this any different from the MySQL Hash Calculator in this category?

No, the algorithm and output format are byte-for-byte identical, both compute '*' + upper(hex(SHA1(SHA1(password)))). This tool exists as a separate page specifically for MariaDB-focused searches and framing, but you'll get the exact same result from either tool for the same input.

Does this tool send my password to a server?

No. The hash is computed entirely in your browser using @noble/hashes, an audited JavaScript library, so nothing you type here is transmitted anywhere.

MariaDB Hash Calculator - Legacy PASSWORD() Function Online

Overview

Introduction

MariaDB forked from MySQL 5.1 in 2009 and, among the many things it inherited unchanged at that fork point, is the exact PASSWORD() hash format still seen in older installations today.

This tool computes that legacy MariaDB PASSWORD() hash for any password you provide, entirely in your browser, useful for older dumps, compatibility work, or understanding a pre-modern-plugin MariaDB system.

What Is MariaDB Hash Calculator?

MariaDB's PASSWORD() function computes '*' + upper(hex(SHA1(SHA1(password)))), identical byte-for-byte to the MySQL function of the same name it was forked from.

It's distinct from MariaDB's modern authentication plugins (ed25519, unix_socket, PAM, and others), which use entirely different, more robust schemes not covered by this tool.

How MariaDB Hash Calculator Works

Your password is first encoded as UTF-8 bytes and hashed once with SHA1, producing a 20-byte intermediate digest.

That intermediate digest is hashed again with SHA1, and the final 20-byte result is hex-encoded, uppercased, and prefixed with a literal asterisk, matching MariaDB's inherited PASSWORD() format exactly.

When To Use MariaDB Hash Calculator

Use this when working with an older MariaDB installation, dump, or migration that still relies on the classic PASSWORD() format.

Never use this format for new authentication design; MariaDB itself has moved toward stronger pluggable auth methods, and this tool's format has no salting or work factor at all.

Often used alongside MySQL Hash Calculator, SHA-1 Hash Calculator and Hash of a Hash Calculator.

Features

Advantages

Exactly matches MariaDB's inherited legacy PASSWORD() format, useful for older installations and dumps.
Simple, deterministic, and easy to verify against a known legacy value.
Shares its implementation and test vectors with the MySQL Hash Calculator, since the underlying algorithm never diverged.

Limitations

No salting: identical passwords always produce identical hashes, making precomputed lookup-table attacks effective.
No configurable work factor; SHA1 is fast, so brute-forcing short passwords is straightforward with modern hardware.
Superseded by MariaDB's own modern authentication plugins in current installations, so this has limited relevance to systems that never adopted the legacy format.

Examples

Hashing the well-known test password

Input

password

Output

*2470C0C06DEE42FD1618BB99005ADCA2EC9D1E19

The same widely cited PASSWORD() test vector shared with MySQL, since MariaDB's implementation was never changed from the point of the fork.

Hashing a short greeting

Input

Hello, world!

Output

*58C9B00E0F4AE70923EE73D782B7B449E4F4A480

The same double-SHA1 construction applied to a different input, identical to the MySQL Hash Calculator's output for this input.

Best Practices & Notes

Best Practices

Only use this format to reproduce or understand legacy MariaDB data, never as a password-storage scheme for anything new.
If migrating an older MariaDB system, plan to move users to a modern authentication plugin (ed25519, PAM, or unix_socket) rather than perpetuating this format.
For any new application, use bcrypt or Argon2, this category's dedicated Bcrypt Hash Calculator is a reasonable starting point.

Developer Notes

Reuses this category's calculateMysqlHash function directly rather than duplicating the algorithm, since MariaDB's PASSWORD() is byte-for-byte identical to MySQL's inherited implementation. Verified against the same widely cited PASSWORD('password') test vector used for the MySQL tool.

MariaDB Hash Calculator Use Cases

Reproducing a legacy MariaDB PASSWORD() value found in an older database dump
Understanding or auditing an older MariaDB authentication setup during a migration
Cross-checking a value against MySQL's identical PASSWORD() implementation
Studying MariaDB's fork history and where its authentication has since diverged from MySQL

Common Mistakes

Assuming this reflects modern MariaDB authentication; current installations typically default to ed25519, unix_socket, or PAM plugins instead.
Using this or any unsalted, fast-hash format for new password storage.
Treating this as somehow different from MySQL's PASSWORD() function; they're identical, since MariaDB inherited it unchanged.

Tips

This exact algorithm and output format is shared with MySQL, use the MySQL Hash Calculator if that framing fits your context better; both tools compute the same thing.
The Hash of a Hash Calculator demonstrates a different, deliberate double-hashing construction (double SHA-256, used by Bitcoin) if you want to compare double-hashing techniques.

MariaDB Hash Calculator