title: How do I add security requirements to the password of my Django custom user model?
body: <p>I'd like to start saying that I'm a beginner to Django, and I've been following a pretty great tutorial so far from Corey Schafer. In the project Corey uses the default Django User model, but I didn't want the users to log in with their username so I decided to override this as the Django docs say at <a href="https://docs.djangoproject.com/en/3.0/topics/auth/customizing/" rel="nofollow noreferrer">https://docs.djangoproject.com/en/3.0/topics/auth/customizing/</a>. </p>
  
  <p>I updated my registration forms with the new models and everything works fine. I can log in, log out and register properly, but I noticed that the password requirements for registration are gone. Previously Django would check if my password was too similar to the rest of my data, and had a minimum length requirement. I would like to know if there is a way to restore this feature.</p>
  
  <p>Here is my code for users/models.py:</p>
  
  <pre><code>from django.db import models
  from django.contrib.auth.models import BaseUserManager, AbstractBaseUser
  from PIL import Image
  
  
  class UserManager(BaseUserManager):
     def create_user(self, email, name, password=None):
         """
         Creates and saves a User with the given email, date of
         birth and password.
         """
         if not email:
             raise ValueError('Users must have an email address')
  
         user = self.model(
             email=self.normalize_email(email),
             name=name,
         )
  
         user.set_password(password)
         user.save(using=self._db)
         return user
  
     def create_superuser(self, email, name, password=None):
         """
         Creates and saves a superuser with the given email, date of
         birth and password.
         """
         user = self.create_user(
             email,
             password=password,
             name=name,
         )
         user.is_admin = True
         user.save(using=self._db)
         return user
  
  
  class User(AbstractBaseUser):
     email = models.EmailField(verbose_name='email address',
                               max_length=255,
                               unique=True)
     name = models.CharField(max_length=63)
     is_active = models.BooleanField(default=True)
     is_admin = models.BooleanField(default=False)
     objects = UserManager()
     USERNAME_FIELD = 'email'
     REQUIRED_FIELDS = ['name']
  
     def __str__(self):
         return self.name
  
     def has_perm(self, perm, obj=None):
         "Does the user have a specific permission?"
         # Simplest possible answer: Yes, always
         return True
  
     def has_module_perms(self, app_label):
         "Does the user have permissions to view the app `app_label`?"
         # Simplest possible answer: Yes, always
         return True
  
     @property
     def is_staff(self):
         "Is the user a member of staff?"
         # Simplest possible answer: All admins are staff
         return self.is_admin
  
  
  class Profile(models.Model):
     user = models.OneToOneField(User, on_delete=models.CASCADE)
     image = models.ImageField(default='default.png', upload_to='profile_pics')
     description = models.TextField(max_length = 255, default = '', blank = True)
  
     def __str__(self):
         return f'{self.user.username} Profile'
  
     def save(self, *args, **kwargs):
         super().save(*args, **kwargs)
         img = Image.open(self.image.path)
         if img.height &gt; 300 or img.width &gt; 300:
             outsize = 300, 300
             img.thumbnail(outsize)
             img.save(self.image.path)
  </code></pre>
  
  <p>This is my code in users/admin.py:</p>
  
  <pre><code>from django.contrib import admin
  from django.contrib.auth.models import Group
  from django.contrib.auth.admin import UserAdmin as BaseUserAdmin
  from django.contrib.auth.forms import ReadOnlyPasswordHashField
  
  from .models import User, Profile
  
  
  class UserCreationForm(forms.ModelForm):
      """A form for creating new users. Includes all the required
      fields, plus a repeated password."""
      password1 = forms.CharField(label='Password', widget=forms.PasswordInput)
      password2 = forms.CharField(label='Password confirmation', widget=forms.PasswordInput)
  
      class Meta:
          model = User
          fields = ('email', 'name')
  
      def clean_password2(self):
          # Check that the two password entries match
          password1 = self.cleaned_data.get("password1")
          password2 = self.cleaned_data.get("password2")
          if password1 and password2 and password1 != password2:
              raise forms.ValidationError("Passwords don't match")
          return password2
  
      def save(self, commit=True):
          # Save the provided password in hashed format
          user = super().save(commit=False)
          user.set_password(self.cleaned_data["password1"])
          if commit:
              user.save()
          return user
  
  
  class UserChangeForm(forms.ModelForm):
      """A form for updating users. Includes all the fields on
      the user, but replaces the password field with admin's
      password hash display field.
      """
      password = ReadOnlyPasswordHashField()
  
      class Meta:
          model = User
          fields = ('email', 'password', 'name', 'is_active', 'is_admin')
  
      def clean_password(self):
          # Regardless of what the user provides, return the initial value.
          # This is done here, rather than on the field, because the
          # field does not have access to the initial value
          return self.initial["password"]
  
  
  class UserAdmin(BaseUserAdmin):
      # The forms to add and change user instances
      form = UserChangeForm
      add_form = UserCreationForm
  
      # The fields to be used in displaying the User model.
      # These override the definitions on the base UserAdmin
      # that reference specific fields on auth.User.
      list_display = ('email', 'name', 'is_admin')
      list_filter = ('is_admin',)
      fieldsets = (
          (None, {'fields': ('email', 'password')}),
          ('Personal info', {'fields': ('name',)}),
          ('Permissions', {'fields': ('is_admin',)}),
      )
      # add_fieldsets is not a standard ModelAdmin attribute. UserAdmin
      # overrides get_fieldsets to use this attribute when creating a user.
      add_fieldsets = (
          (None, {
              'classes': ('wide',),
              'fields': ('email', 'name', 'password1', 'password2'),
          }),
      )
      search_fields = ('email',)
      ordering = ('email',)
      filter_horizontal = ()
  
  
  admin.site.unregister(Group)
  admin.site.register(User, UserAdmin)
  admin.site.register(Profile)
  </code></pre>
  
  <p>And this is users/forms.py:</p>
  
  <pre><code>from .models import User
  from .admin import UserCreationForm
  from .models import Profile
  
  
  class UserRegistrationForm(UserCreationForm):
      email = forms.EmailField()
  
  
      class Meta:
          model = User 
          fields = ['name', 'email', 'password1', 'password2'] 
  
  class UserUpdateForm(forms.ModelForm):
      email = forms.EmailField()
  
      class Meta:
          model = User
          fields = ['name', 'email']
  
  class ProfileUpdateForm(forms.ModelForm):
      class Meta:
          model = Profile
          fields = ['image', 'description']
  </code></pre>