•Passwords specified as hashed values are not checked because the original password value is not available for checking: 

mysql> ALTER USER ’jeffrey’@’localhost’ IDENTIFIED WITH mysql_native_password AS ’*0D3CED9BEC10A777AEC23CCC353A8C08A633045E’; Query OK, 0 rows affected (0.01 sec) 

•This account-creation statement fails, even though the account is locked initially, because it does not include a password that satisfies the current password policy: 

mysql> CREATE USER ’juanita’@’localhost’ ACCOUNT LOCK; ERROR 1819 (HY000): Your password does not satisfy the current policy requirements 

•To check a password, use the VALIDATE_PASSWORD_STRENGTH()  function: 

mysql> SELECT VALIDATE_PASSWORD_STRENGTH(’weak’); +------------------------------------+ | VALIDATE_PASSWORD_STRENGTH(’weak’) | +------------------------------------+ | 25 | +------------------------------------+ mysql> SELECT VALIDATE_PASSWORD_STRENGTH(’lessweak$_@123’); +----------------------------------------------+ | VALIDATE_PASSWORD_STRENGTH(’lessweak$_@123’) | +----------------------------------------------+ | 50 | +----------------------------------------------+ mysql> SELECT VALIDATE_PASSWORD_STRENGTH(’N0Tweak$_@123!’); +----------------------------------------------+ | VALIDATE_PASSWORD_STRENGTH(’N0Tweak$_@123!’) | +----------------------------------------------+ | 100 | +----------------------------------------------+ 

To configure password checking, modify the system variables having names of the form validate_password. xxx ; these are the parameters that control password policy. See Section 6.4.3.2, “Password Validation Options and Variables” . 

If validate_password  is not installed, the validate_password. xxx  system variables are not available, passwords in statements are not checked, and the VALIDATE_PASSWORD_STRENGTH() function always returns 0. For example, without the plugin installed, accounts can be assigned passwords shorter than 8 characters, or no password at all. 

Assuming that validate_password  is installed, it implements three levels of password checking: LOW , MEDIUM , and STRONG . The default is MEDIUM ; to change this, modify the value of validate_password.policy . The policies implement increasingly strict password tests. The following descriptions refer to default parameter values, which can be modified by changing the appropriate system variables. 

• LOW  policy tests password length only. Passwords must be at least 8 characters long. To change this length, modify validate_password.length . 

• MEDIUM  policy adds the conditions that passwords must contain at least 1 numeric character, 1 lowercase character, 1 uppercase character, and 1 special (nonalphanumeric) character. To change these values, modify validate_password.number_count , validate_password.mixed_case_count , and validate_password.special_char_count . 

• STRONG  policy adds the condition that password substrings of length 4 or longer must not match words in the dictionary file, if one has been specified. To specify the dictionary file, modify validate_password.dictionary_file . 

