Description\n-----------\n\n_Password validation_ means ensuring that user passwords meet certain minimal security requirements. A dedicated plugin API allows the creation of password validation plugins that will check user passwords as they are set (in SET PASSWORD and GRANT statements) and either allow or reject them.\n\nSQL-Level Extensions\n\nMariaDB comes with three password validation plugins — the simple_password_check plugin, the cracklib_password_check plugin and the password_reuse_check plugin. They are not enabled by default – use INSTALL SONAME (or INSTALL PLUGIN) statement to install them.\n\nWhen at least one password plugin is loaded, all new passwords will be validated and password-changing statements will fail if the password will not pass validation checks. Several password validation plugin can be loaded at the same time — in this case a password must pass all validation checks by all plugins.\n\nPassword-Changing Statements\n\nOne can use various SQL statements to change a user password:\n\nWith Plain Text Password\n\n``sql\nSET PASSWORD = PASSWORD('plain-text password');\nSET PASSWORD FOR user@host = PASSWORD('plain-text password');\nSET PASSWORD = OLD_PASSWORD('plain-text password');\nSET PASSWORD FOR user@host = OLD_PASSWORD('plain-text password');\nCREATE USER user@host IDENTIFIED BY 'plain-text password';\nGRANT PRIVILEGES TO user@host IDENTIFIED BY 'plain-text password';\n`\n\nThese statements are subject to password validation. If at least one password validation plugin is loaded, plain-text passwords specified in these statements will be validated.\n\nWith Password Hash\n\n`sql\nSET PASSWORD = 'password hash';\nSET PASSWORD FOR user@host = 'password hash';\nCREATE USER user@host IDENTIFIED BY PASSWORD 'password hash';\nCREATE USER user@host IDENTIFIED VIA mysql_native_password USING 'password hash';\nCREATE USER user@host IDENTIFIED VIA mysql_old_password USING 'password hash';\nGRANT PRIVILEGES TO user@host IDENTIFIED BY PASSWORD 'password hash';\nGRANT PRIVILEGES TO user@host IDENTIFIED VIA mysql_native_password USING 'password hash';\nGRANT PRIVILEGES TO user@host IDENTIFIED VIA mysql_old_password USING 'password hash';\n``\n\nThese statements can not possibly use password validation — there is nothing to validate, the original plain-text password is not available.\n\nMariaDB introduces a strict password validation mode — controlled by a strict_password_validation global server variable.\n\nIf the strict password validation is enabled and at least one password validation plugin is loaded, passwords that cannot be validated are rejected; otherwise, they're  accepted. By default, a strict password validation is enabled (but note that it has no effect if no password validation plugin is loaded).\n\nExamples\n--------\n\nGRANT SELECT ON . to foobar IDENTIFIED BY 'raboof';\nERROR HY000: Your password does not satisfy the current policy requirements\n\nSHOW WARNINGS;\n+---------+------+----------------------------------------------------------------+\n| Level	  | Code | Message                                                        |\n+---------+------+----------------------------------------------------------------+\n| Warning | 1819 | cracklib: it is based on your username                         |\n| Error	  | 1819 | Your password does not satisfy the current policy requirements |\n+---------+------+----------------------------------------------------------------+\n\nURL: https://mariadb.com/docs/server/reference/plugins/password-validation-plugins/password-validation