phacility/phabricator · warning · PhabricatorAuthPasswordException

The password you entered is very similar to a nonsecret acco

Error message

The password you entered is very similar to a nonsecret account identifier (like a username or email address). Choose a more distinct password.

What it means

The blocklist check in checkNewPassword(): newPasswordBlocklist() collects nonsecret identifiers (username, real name, email) and normalized fragments; if the normalized password contains any term, or any term contains the password (substring test in both directions), the exception is thrown with 'Not Distinct'. This stops passwords like 'alincoln', 'lincoln', or 'alincoln1' for user 'alincoln'.

Source

Thrown at src/applications/auth/engine/PhabricatorAuthPasswordEngine.php:195

    }

    // Finally, make sure that none of the terms appear in the password,
    // and that the password does not appear in any of the terms.
    $normal_password = phutil_utf8_strtolower($raw_password);
    if (strlen($normal_password) >= $minimum_similarity) {
      foreach ($normal_map as $term => $source) {

        // See T2312. This may be required if the term list includes numeric
        // strings like "12345", which will be cast to integers when used as
        // array keys.
        $term = phutil_string_cast($term);

        if (strpos($term, $normal_password) === false &&
            strpos($normal_password, $term) === false) {
          continue;
        }

        throw new PhabricatorAuthPasswordException(
          pht(
            'The password you entered is very similar to a nonsecret account '.
            'identifier (like a username or email address). Choose a more '.
            'distinct password.'),
          pht('Not Distinct'));
      }
    }
  }

  public function isValidPassword(PhutilOpaqueEnvelope $envelope) {
    $this->requireSetup();

    $password_type = $this->getPasswordType();

    $passwords = $this->newQuery()
      ->withPasswordTypes(array($password_type))
      ->withIsRevoked(false)
      ->execute();

View on GitHub (pinned to 5720a38cfe)

Solutions

1. Choose a password that shares no substring with your username, email, or real name.
2. In test fixtures, use random strings unrelated to account identifiers.
3. Catch PhabricatorAuthPasswordException and render the 'Not Distinct' error on the password field.

try {
  $engine->checkNewPassword($password, $confirm);
} catch (PhabricatorAuthPasswordException $ex) {
  if ($ex->getPasswordError() === pht('Not Distinct')) {
    // hint: do not reuse username/email/name or fragments of them
  }
}

When it happens

Trigger: Any checkNewPassword() call where the password, after normalization, embeds a blocklisted identifier or a fragment of it - the username itself, the email local part, the display name, or substrings thereof (numeric suffixes like 'alincoln1' still match because the term is a substring of the password).

Common situations: Users constructing passwords from their own username or email; corporate accounts where the email is firstname.lastname and the password embeds it; test fixtures using account names as passwords.

Related errors

• The selected password is very weak: it is one of the most co
• You must choose a password or skip this step.
• You must choose a password.
• The selected password is too short. Passwords must be a mini
• You must confirm the selected password.

AI-assisted analysis of phacility/phabricator@5720a38cfe (2026-08-21). Data as JSON: /api/errors/4e3c268d13965058. Report an issue: GitHub.