{"record":{"id":"4e3c268d13965058","repo":"phacility/phabricator","slug":"the-password-you-entered-is-very-similar-to-a-nons","errorCode":null,"errorMessage":"The password you entered is very similar to a nonsecret account identifier (like a username or email address). Choose a more distinct password.","messagePattern":"The password you entered is very similar to a nonsecret account identifier \\(like a username or email address\\)\\. Choose a more distinct password\\.","errorType":"validation","errorClass":"PhabricatorAuthPasswordException","httpStatus":null,"severity":"warning","filePath":"src/applications/auth/engine/PhabricatorAuthPasswordEngine.php","lineNumber":195,"sourceCode":"    }\n\n    // Finally, make sure that none of the terms appear in the password,\n    // and that the password does not appear in any of the terms.\n    $normal_password = phutil_utf8_strtolower($raw_password);\n    if (strlen($normal_password) >= $minimum_similarity) {\n      foreach ($normal_map as $term => $source) {\n\n        // See T2312. This may be required if the term list includes numeric\n        // strings like \"12345\", which will be cast to integers when used as\n        // array keys.\n        $term = phutil_string_cast($term);\n\n        if (strpos($term, $normal_password) === false &&\n            strpos($normal_password, $term) === false) {\n          continue;\n        }\n\n        throw new PhabricatorAuthPasswordException(\n          pht(\n            'The password you entered is very similar to a nonsecret account '.\n            'identifier (like a username or email address). Choose a more '.\n            'distinct password.'),\n          pht('Not Distinct'));\n      }\n    }\n  }\n\n  public function isValidPassword(PhutilOpaqueEnvelope $envelope) {\n    $this->requireSetup();\n\n    $password_type = $this->getPasswordType();\n\n    $passwords = $this->newQuery()\n      ->withPasswordTypes(array($password_type))\n      ->withIsRevoked(false)\n      ->execute();","sourceCodeStart":177,"sourceCodeEnd":213,"githubUrl":"https://github.com/phacility/phabricator/blob/5720a38cfe95b00ca4be5016dd0d2f3195f4fa04/src/applications/auth/engine/PhabricatorAuthPasswordEngine.php#L177-L213","documentation":"The blocklist check in checkNewPassword(): newPasswordBlocklist() collects nonsecret identifiers (username, real name, email) and normalized fragments; if the normalized password contains any term, or any term contains the password (substring test in both directions), the exception is thrown with 'Not Distinct'. This stops passwords like 'alincoln', 'lincoln', or 'alincoln1' for user 'alincoln'.","triggerScenarios":"Any checkNewPassword() call where the password, after normalization, embeds a blocklisted identifier or a fragment of it - the username itself, the email local part, the display name, or substrings thereof (numeric suffixes like 'alincoln1' still match because the term is a substring of the password).","commonSituations":"Users constructing passwords from their own username or email; corporate accounts where the email is firstname.lastname and the password embeds it; test fixtures using account names as passwords.","solutions":["Choose a password that shares no substring with your username, email, or real name.","In test fixtures, use random strings unrelated to account identifiers.","Catch PhabricatorAuthPasswordException and render the 'Not Distinct' error on the password field."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n  $engine->checkNewPassword($password, $confirm);\n} catch (PhabricatorAuthPasswordException $ex) {\n  if ($ex->getPasswordError() === pht('Not Distinct')) {\n    // hint: do not reuse username/email/name or fragments of them\n  }\n}","preventionTips":["Keep passwords free of any substring of your username, email, or real name (including with digit suffixes).","In test fixtures, use random strings unrelated to account identifiers.","Hint at the rule in the form UI so users understand why 'username1' is rejected."],"tags":["phabricator","password","validation","weak-password","blocklist","php"],"backgroundTag":"password-validation-failed","analyzedSha":"5720a38cfe95b00ca4be5016dd0d2f3195f4fa04","analyzedAt":"2026-08-21T05:07:25.672Z","schemaVersion":2},"datasetVersion":"2026-08-21T11:28:35.574Z"}