validate that the password meets all validator requirements if the password is valid return none if the password is invalid raise validationerror with all error messages inform all validators that have implemented a passwordchanged method that the password has been changed return a list of all help texts of all configured validators return an html string with all help texts of all configured validators in an ul validate that the password is of a minimum length test that value is within a reasonable range of password the following ratio calculations are based on testing sequencematcher like this for i in range0 6 print10i sequencematchera a b a 10i quickratio which yields 1 1 0 10 0 18181818181818182 100 0 019801980198019802 1000 0 001998001998001998 10000 0 00019998000199980003 100000 1 999980000199998e05 this means a lengthratio of 10 should never yield a similarity higher than 0 2 for 100 this is down to 0 02 and for 1000 it is 0 002 this can be calculated via 2 lengthratio as a result we avoid the potentially expensive sequence matching validate that the password is sufficiently different from the user s attributes if no specific attributes are provided look at a sensible list of defaults attributes that don t exist are ignored comparison is made to not only the full attribute value but also its components so that for example a password is validated against either part of an email address as well as the full address validate that the password is not a common password the password is rejected if it occurs in a provided list of passwords which may be gzipped the list django ships with contains 20000 common passwords lowercased and deduplicated royce williams https gist github comroycewilliams226886fd01572964e1431ac8afc999ce the password list must be lowercased to match the comparison in validate validate that the password is not entirely numeric validate that the password meets all validator requirements if the password is valid return none if the password is invalid raise validationerror with all error messages inform all validators that have implemented a password_changed method that the password has been changed return a list of all help texts of all configured validators return an html string with all help texts of all configured validators in an ul validate that the password is of a minimum length test that value is within a reasonable range of password the following ratio calculations are based on testing sequencematcher like this for i in range 0 6 print 10 i sequencematcher a a b a 10 i quick_ratio which yields 1 1 0 10 0 18181818181818182 100 0 019801980198019802 1000 0 001998001998001998 10000 0 00019998000199980003 100000 1 999980000199998e 05 this means a length_ratio of 10 should never yield a similarity higher than 0 2 for 100 this is down to 0 02 and for 1000 it is 0 002 this can be calculated via 2 length_ratio as a result we avoid the potentially expensive sequence matching validate that the password is sufficiently different from the user s attributes if no specific attributes are provided look at a sensible list of defaults attributes that don t exist are ignored comparison is made to not only the full attribute value but also its components so that for example a password is validated against either part of an email address as well as the full address validate that the password is not a common password the password is rejected if it occurs in a provided list of passwords which may be gzipped the list django ships with contains 20000 common passwords lowercased and deduplicated royce williams https gist github com roycewilliams 226886fd01572964e1431ac8afc999ce the password list must be lowercased to match the comparison in validate validate that the password is not entirely numeric
import functools
import gzip
import re
from difflib import SequenceMatcher
from pathlib import Path

from django.conf import settings
from django.core.exceptions import (
    FieldDoesNotExist,
    ImproperlyConfigured,
    ValidationError,
)
from django.utils.functional import cached_property, lazy
from django.utils.html import format_html, format_html_join
from django.utils.module_loading import import_string
from django.utils.translation import gettext as _
from django.utils.translation import ngettext


@functools.cache
def get_default_password_validators():
    return get_password_validators(settings.AUTH_PASSWORD_VALIDATORS)


def get_password_validators(validator_config):
    validators = []
    for validator in validator_config:
        try:
            klass = import_string(validator["NAME"])
        except ImportError:
            msg = (
                "The module in NAME could not be imported: %s. Check your "
                "AUTH_PASSWORD_VALIDATORS setting."
            )
            raise ImproperlyConfigured(msg % validator["NAME"])
        validators.append(klass(**validator.get("OPTIONS", {})))

    return validators


def validate_password(password, user=None, password_validators=None):
    
    errors = []
    if password_validators is None:
        password_validators = get_default_password_validators()
    for validator in password_validators:
        try:
            validator.validate(password, user)
        except ValidationError as error:
            errors.append(error)
    if errors:
        raise ValidationError(errors)


def password_changed(password, user=None, password_validators=None):
    
    if password_validators is None:
        password_validators = get_default_password_validators()
    for validator in password_validators:
        password_changed = getattr(validator, "password_changed", lambda *a: None)
        password_changed(password, user)


def password_validators_help_texts(password_validators=None):
    
    help_texts = []
    if password_validators is None:
        password_validators = get_default_password_validators()
    for validator in password_validators:
        help_texts.append(validator.get_help_text())
    return help_texts


def _password_validators_help_text_html(password_validators=None):
    
    help_texts = password_validators_help_texts(password_validators)
    help_items = format_html_join(
        "", "<li>{}</li>", ((help_text,) for help_text in help_texts)
    )
    return format_html("<ul>{}</ul>", help_items) if help_items else ""


password_validators_help_text_html = lazy(_password_validators_help_text_html, str)


class MinimumLengthValidator:
    

    def __init__(self, min_length=8):
        self.min_length = min_length

    def validate(self, password, user=None):
        if len(password) < self.min_length:
            raise ValidationError(
                ngettext(
                    "This password is too short. It must contain at least "
                    "%(min_length)d character.",
                    "This password is too short. It must contain at least "
                    "%(min_length)d characters.",
                    self.min_length,
                ),
                code="password_too_short",
                params={"min_length": self.min_length},
            )

    def get_help_text(self):
        return ngettext(
            "Your password must contain at least %(min_length)d character.",
            "Your password must contain at least %(min_length)d characters.",
            self.min_length,
        ) % {"min_length": self.min_length}


def exceeds_maximum_length_ratio(password, max_similarity, value):
    
    pwd_len = len(password)
    length_bound_similarity = max_similarity / 2 * pwd_len
    value_len = len(value)
    return pwd_len >= 10 * value_len and value_len < length_bound_similarity


class UserAttributeSimilarityValidator:
    

    DEFAULT_USER_ATTRIBUTES = ("username", "first_name", "last_name", "email")

    def __init__(self, user_attributes=DEFAULT_USER_ATTRIBUTES, max_similarity=0.7):
        self.user_attributes = user_attributes
        if max_similarity < 0.1:
            raise ValueError("max_similarity must be at least 0.1")
        self.max_similarity = max_similarity

    def validate(self, password, user=None):
        if not user:
            return

        password = password.lower()
        for attribute_name in self.user_attributes:
            value = getattr(user, attribute_name, None)
            if not value or not isinstance(value, str):
                continue
            value_lower = value.lower()
            value_parts = re.split(r"\W+", value_lower) + [value_lower]
            for value_part in value_parts:
                if exceeds_maximum_length_ratio(
                    password, self.max_similarity, value_part
                ):
                    continue
                if (
                    SequenceMatcher(a=password, b=value_part).quick_ratio()
                    >= self.max_similarity
                ):
                    try:
                        verbose_name = str(
                            user._meta.get_field(attribute_name).verbose_name
                        )
                    except FieldDoesNotExist:
                        verbose_name = attribute_name
                    raise ValidationError(
                        _("The password is too similar to the %(verbose_name)s."),
                        code="password_too_similar",
                        params={"verbose_name": verbose_name},
                    )

    def get_help_text(self):
        return _(
            "Your password can’t be too similar to your other personal information."
        )


class CommonPasswordValidator:
    

    @cached_property
    def DEFAULT_PASSWORD_LIST_PATH(self):
        return Path(__file__).resolve().parent / "common-passwords.txt.gz"

    def __init__(self, password_list_path=DEFAULT_PASSWORD_LIST_PATH):
        if password_list_path is CommonPasswordValidator.DEFAULT_PASSWORD_LIST_PATH:
            password_list_path = self.DEFAULT_PASSWORD_LIST_PATH
        try:
            with gzip.open(password_list_path, "rt", encoding="utf-8") as f:
                self.passwords = {x.strip() for x in f}
        except OSError:
            with open(password_list_path) as f:
                self.passwords = {x.strip() for x in f}

    def validate(self, password, user=None):
        if password.lower().strip() in self.passwords:
            raise ValidationError(
                _("This password is too common."),
                code="password_too_common",
            )

    def get_help_text(self):
        return _("Your password can’t be a commonly used password.")


class NumericPasswordValidator:
    

    def validate(self, password, user=None):
        if password.isdigit():
            raise ValidationError(
                _("This password is entirely numeric."),
                code="password_entirely_numeric",
            )

    def get_help_text(self):
        return _("Your password can’t be entirely numeric.")