{"record":{"id":"7f7fa1c496b6112b","repo":"makeplane/plane","slug":"password-is-too-common-please-set-a-complex-passwo","errorCode":null,"errorMessage":"Password is too common please set a complex password","messagePattern":"Password is too common please set a complex password","errorType":"console","errorClass":"CommandError","httpStatus":null,"severity":"error","filePath":"apps/api/plane/db/management/commands/reset_password.py","lineNumber":59,"sourceCode":"\n        # get password for the user\n        password = getpass.getpass(\"Password: \")\n        confirm_password = getpass.getpass(\"Password (again): \")\n\n        # If the passwords doesn't match raise error\n        if password != confirm_password:\n            self.stderr.write(\"Error: Your passwords didn't match.\")\n            return\n\n        # Blank passwords should not be allowed\n        if password.strip() == \"\":\n            self.stderr.write(\"Error: Blank passwords aren't allowed.\")\n            return\n\n        results = zxcvbn(password)\n\n        if results[\"score\"] < 3:\n            raise CommandError(\"Password is too common please set a complex password\")\n\n        # Set user password\n        user.set_password(password)\n        user.is_password_autoset = False\n        user.save()\n\n        self.stdout.write(self.style.SUCCESS(\"User password updated successfully\"))\n","sourceCodeStart":41,"sourceCodeEnd":67,"githubUrl":"https://github.com/makeplane/plane/blob/1c8a60f858d8472aa56e29994ec1c7926da2c6ce/apps/api/plane/db/management/commands/reset_password.py#L41-L67","documentation":"Raised by the `reset_password` Django management command when zxcvbn rates the entered password with a score below 3 (out of 4). zxcvbn scores 0-2 as weak/guessable, so the command rejects passwords it deems not strong. The check runs only after the blank-password and match guards pass, and is raised as a CommandError (non-zero exit).","triggerScenarios":"Running `python manage.py reset_password <email>` interactively, entering two matching non-blank passwords, where zxcvbn scores the result 0, 1, or 2. Common with dictionary words, short passwords, passwords containing the user's email/name fragments, or repeated/sequential characters.","commonSituations":"Operators resetting a locked-out user's password via the CLI; using a simple word plus a digit (e.g. `plane123`); reusing a password derived from the user's email handle; automating the command in a script that pipes in a weak value.","solutions":["Enter a password zxcvbn scores 3+: 12+ mixed-case characters with symbols and digits, avoiding dictionary words and the user's email/name.","Run the password through a zxcvbn checker beforehand and aim for score 3 or 4 before submitting it to the command.","If you must script it, generate a strong random password (e.g. `openssl rand -base64 18`) and feed it via getpass-compatible stdin.","Note the threshold is hardcoded to `< 3` at reset_password.py:58; lowering it requires editing the source."],"exampleFix":"// before\npassword = \"plane123\"  // zxcvbn score ~1\n\n// after\npassword = \"7qK$mP2!vR9wLx#\"  // zxcvbn score 4","handlingStrategy":"validation","validationCode":"from zxcvbn import zxcvbn\n\ndef is_password_strong_enough(password: str) -> bool:\n    # reset_password.py:58 rejects scores < 3\n    return zxcvbn(password)[\"score\"] >= 3\n\n# prompt again if not\nwhile not is_password_strong_enough(pw):\n    pw = getpass.getpass(\"Password: \")","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Pre-test passwords with zxcvbn before running reset_password.","Generate random 16+ char passwords for scripted resets.","Avoid embedding the user's email or display name in the password."],"tags":["password","zxcvbn","management-command","security"],"backgroundTag":null,"analyzedSha":"1c8a60f858d8472aa56e29994ec1c7926da2c6ce","analyzedAt":"2026-08-12T14:44:31.636Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}