The Password Validation Component The  validate_password  component serves to improve security by requiring account passwords and enabling strength testing of potential passwords. This component exposes system variables that enable you to configure password policy, and status variables for component monitoring. In MySQL 8.0, the  validate_password  plugin was reimplemented as the validate_password  component. (For general information about components, see Section 5.5, “MySQL Components” .) The following instructions describe how to use the component, not the plugin. For instructions on using the plugin form of  validate_password , see The Password Validation Plugin, in MySQL 5.7 Reference Manual. The plugin form of  validate_password  is still available but is deprecated; expect it to be removed in a future version of MySQL. MySQL installations that use the plugin should make the transition to using the component instead. See Section 6.4.3.3, “Transitioning to the Password Validation Component” . The  validate_password  component implements these capabilities: For statements that assign or modify account passwords ( ALTER USER ,  CREATE USER , and  SET PASSWORD ), the  validate_password  capabilities described here apply only to accounts that use an authentication plugin that stores credentials internally to MySQL. For accounts that use plugins that perform authentication against a credentials system external to MySQL, password management must be handled externally against that system as well. For more information about internal credentials storage, see Section 6.2.15, “Password Management” . The preceding restriction does not apply to use of the VALIDATE_PASSWORD_STRENGTH()  function because it does not affect accounts directly. Examples: 1385 mysql>  ALTER USER USER() IDENTIFIED BY ’abc’; ERROR 1819 (HY000): Your password does not satisfy the current policy requirements • validate_password  checks the cleartext password in the following statement. Under the default password policy, which requires passwords to be at least 8 characters long, the password is weak and the statement produces an error: • validate_password  implements a  VALIDATE_PASSWORD_STRENGTH()  SQL function that assesses the strength of potential passwords. This function takes a password argument and returns an integer from 0 (weak) to 100 (strong). •For  CREATE USER  statements,  validate_password  requires that a password be given, and that it satisfies the password policy. This is true even if an account is locked initially because otherwise unlocking the account later would cause it to become accessible without a password that satisfies the policy. •For SQL statements that assign a password supplied as a cleartext value,  validate_password checks the password against the current password policy and rejects the password if it is weak (the statement returns an  ER_NOT_VALID_PASSWORD  error). This applies to the  ALTER USER ,  CREATE USER , and  SET PASSWORD  statements. Note Note