makeplane/plane · error · CommandError

Password is too common please set a complex password

Error message

Password is too common please set a complex password

What it means

Raised by the `reset_password` Django management command when zxcvbn rates the entered password with a score below 3 (out of 4). zxcvbn scores 0-2 as weak/guessable, so the command rejects passwords it deems not strong. The check runs only after the blank-password and match guards pass, and is raised as a CommandError (non-zero exit).

Source

Thrown at apps/api/plane/db/management/commands/reset_password.py:59

        # get password for the user
        password = getpass.getpass("Password: ")
        confirm_password = getpass.getpass("Password (again): ")

        # If the passwords doesn't match raise error
        if password != confirm_password:
            self.stderr.write("Error: Your passwords didn't match.")
            return

        # Blank passwords should not be allowed
        if password.strip() == "":
            self.stderr.write("Error: Blank passwords aren't allowed.")
            return

        results = zxcvbn(password)

        if results["score"] < 3:
            raise CommandError("Password is too common please set a complex password")

        # Set user password
        user.set_password(password)
        user.is_password_autoset = False
        user.save()

        self.stdout.write(self.style.SUCCESS("User password updated successfully"))

View on GitHub (pinned to 1c8a60f858)

Solutions

1. Enter a password zxcvbn scores 3+: 12+ mixed-case characters with symbols and digits, avoiding dictionary words and the user's email/name.
2. Run the password through a zxcvbn checker beforehand and aim for score 3 or 4 before submitting it to the command.
3. If you must script it, generate a strong random password (e.g. `openssl rand -base64 18`) and feed it via getpass-compatible stdin.
4. Note the threshold is hardcoded to `< 3` at reset_password.py:58; lowering it requires editing the source.

Example fix

// before
password = "plane123"  // zxcvbn score ~1

// after
password = "7qK$mP2!vR9wLx#"  // zxcvbn score 4

from zxcvbn import zxcvbn

def is_password_strong_enough(password: str) -> bool:
    # reset_password.py:58 rejects scores < 3
    return zxcvbn(password)["score"] >= 3

# prompt again if not
while not is_password_strong_enough(pw):
    pw = getpass.getpass("Password: ")

When it happens

Trigger: Running `python manage.py reset_password <email>` interactively, entering two matching non-blank passwords, where zxcvbn scores the result 0, 1, or 2. Common with dictionary words, short passwords, passwords containing the user's email/name fragments, or repeated/sequential characters.

Common situations: Operators resetting a locked-out user's password via the CLI; using a simple word plus a digit (e.g. `plane123`); reusing a password derived from the user's email handle; automating the command in a script that pipes in a weak value.

Related errors

• 5021
• 5019
• 5017
• 5035|5065
• User email is required and should have signed in plane

AI-assisted analysis of makeplane/plane@1c8a60f858 (2026-08-12). Data as JSON: /api/errors/7f7fa1c496b6112b. Report an issue: GitHub.