diff --git a/src/factory/MySQLTaskImpl.cc b/src/factory/MySQLTaskImpl.cc
index 63d57174..bdc94fac 100644
--- a/src/factory/MySQLTaskImpl.cc
+++ b/src/factory/MySQLTaskImpl.cc
@@ -369,7 +369,7 @@ int ComplexMySQLTask::check_handshake(MySQLHandshakeResponse *resp)
 	auto *my_conn = new MyConnection(ssl);
 
 	my_conn->str = resp->get_auth_plugin_name();
-	if (my_conn->str == "sha256_password")
+	if (!password_.empty() && my_conn->str == "sha256_password")
 		my_conn->str = "caching_sha2_password";
 
 	resp->get_seed(my_conn->seed);
@@ -397,7 +397,11 @@ int ComplexMySQLTask::auth_switch(MySQLAuthResponse *resp, MyConnection *conn)
 		return 0;
 	}
 
-	if (name == "sha256_password")
+	if (password_.empty())
+	{
+		conn->state = ST_CLEAR_PASSWORD_REQUEST;
+	}
+	else if (name == "sha256_password")
 	{
 		if (is_ssl_)
 			conn->state = ST_CLEAR_PASSWORD_REQUEST;
diff --git a/src/protocol/MySQLMessage.cc b/src/protocol/MySQLMessage.cc
index 83a3a2b3..df91be67 100644
--- a/src/protocol/MySQLMessage.cc
+++ b/src/protocol/MySQLMessage.cc
@@ -491,7 +491,11 @@ int MySQLAuthResponse::decode_packet(const unsigned char *buf, size_t buflen)
 
 int MySQLAuthSwitchRequest::encode(struct iovec vectors[], int max)
 {
-	if (auth_plugin_name_ == MYSQL_NATIVE_PASSWORD)
+	if (password_.empty())
+	{
+		buf_ = "\0";
+	}
+	else if (auth_plugin_name_ == MYSQL_NATIVE_PASSWORD)
 	{
 		buf_ = __native_password_encrypt(password_, seed_);
 	}