MySQL 5.7 to 8.0: Default Authentication Plugin Change

Why MySQL 8.0 switched from mysql_native_password to caching_sha2_password by default, and how it breaks older client libraries and drivers.

MySQL 5.7 → MySQL 8.0

Quick answer

MySQL 8.0.4+ creates new user accounts with caching_sha2_password by default instead of mysql_native_password. Older client libraries/drivers that predate this plugin will fail to connect new accounts until they are updated or the account is explicitly recreated with mysql_native_password.

Why it matters

This is one of the most common "why can't my app connect after upgrading" issues. It only affects newly created accounts (or ones explicitly ALTERed) — existing 5.7 accounts keep their original plugin after an in-place upgrade — but any fresh account creation, container image, or CI database setup script run against 8.0+ picks up the new default silently.

Example

-- MySQL 5.7 default
CREATE USER 'app'@'%' IDENTIFIED BY 'secret';
-- uses mysql_native_password

-- MySQL 8.0+ default
CREATE USER 'app'@'%' IDENTIFIED BY 'secret';
-- uses caching_sha2_password unless explicitly overridden

The exact same CREATE USER statement produces an account with a different authentication plugin depending on server version — nothing in the SQL itself signals the change.

What to do about it

Migration steps

Check each application's MySQL client library/driver version supports caching_sha2_password (most actively maintained drivers from 2020+ do).
If a driver cannot be upgraded, explicitly create/alter the account with the old plugin: ALTER USER 'user'@'host' IDENTIFIED WITH mysql_native_password BY 'password';
For new deployments, prefer upgrading the driver over downgrading the plugin — caching_sha2_password is the more secure default going forward.

References

MySQL 8.0 Reference Manual — Caching SHA-2 Pluggable Authentication (v8.0) — checked 2026-07-31
MySQL 8.0 Reference Manual — Changes Affecting Upgrades to MySQL 8.0 (v8.0) — checked 2026-07-31

Last verified 2026-07-31.