Introduction

MySQL password rules are enforced by either the validate_password plugin or the validate_password component, depending on server version and setup. Disabling validation is possible, but it should be limited to controlled development environments because it weakens account security. In most cases, lowering policy strength is safer than fully turning validation off.

Identify Whether Plugin or Component Is Active

Before making changes, verify what mechanism your server is using. Plugin and component commands are different.

1SHOW PLUGINS;
2SELECT *
3FROM mysql.component
4WHERE component_urn LIKE '%validate_password%';

If you see validate_password in SHOW PLUGINS, you are using plugin mode. If you see component_validate_password in mysql.component, you are using component mode.

Do not run uninstall commands until this check is done.

Safer Option: Relax Validation Instead of Disabling

For local development, reducing strictness often solves the immediate issue without removing protection entirely.

1SHOW VARIABLES LIKE 'validate_password%';
2
3SET GLOBAL validate_password.policy = LOW;
4SET GLOBAL validate_password.length = 6;
5SET GLOBAL validate_password.check_user_name = OFF;
6
7SHOW VARIABLES LIKE 'validate_password%';

This keeps basic controls while allowing simpler temporary credentials.

If your server supports persistent variables, apply with SET PERSIST so changes survive restart.

SET PERSIST validate_password.policy = LOW;
SET PERSIST validate_password.length = 6;

Disable in Plugin Mode

If full disablement is required in a non-production environment, uninstall the plugin.

UNINSTALL PLUGIN validate_password;
SHOW PLUGINS;

After uninstalling, create a test user to verify behavior.

CREATE USER 'dev_user'@'localhost' IDENTIFIED BY '123456';

If this still fails, another policy layer may be active, such as external account-management automation.

Disable in Component Mode

For component-based setups, uninstall with component syntax.

1UNINSTALL COMPONENT 'file://component_validate_password';
2
3SELECT *
4FROM mysql.component
5WHERE component_urn LIKE '%validate_password%';

Component commands do not work on plugin setups and vice versa, so mode detection is mandatory.

Make Changes Persistent with Configuration Files

Runtime changes can disappear after restart. For stable local environments, set desired behavior in MySQL config.

1[mysqld]
2validate_password.policy=LOW
3validate_password.length=6
4validate_password.check_user_name=OFF

Use full disablement in config only for isolated test servers. For shared environments, keep validation enabled and tune policy minimally.

Re-Enable Validation Cleanly

Always keep a rollback path ready before disabling security features.

Plugin rollback example:

INSTALL PLUGIN validate_password SONAME 'validate_password.so';
SET GLOBAL validate_password.policy = MEDIUM;
SET GLOBAL validate_password.length = 8;

Component rollback example:

INSTALL COMPONENT 'file://component_validate_password';

After rollback, test user creation with weak and strong passwords to confirm policy behavior.

Environment Strategy

A practical policy by environment:

• local laptop sandbox: LOW policy acceptable
• CI ephemeral database: optionally disabled in isolated network, destroyed after run
• shared staging: enabled with moderate policy
• production: enabled with audited strong policy

This gives developers flexibility while keeping meaningful security controls where risk is real.

Audit and Operational Notes

Disabling validation can violate internal security baselines. Log who changed policy, why, and for how long. If you run infrastructure as code, track MySQL variable and plugin state changes in version control for auditability.

Also check automation scripts that create users. Some scripts assume validation remains enabled and may silently create weaker credentials once disabled.

Common Pitfalls

• Running component uninstall commands on a plugin-based server, which does nothing useful.
• Disabling validation in shared or production environments without risk approval.
• Forgetting persistence behavior, so settings revert after restart unexpectedly.
• Assuming password validation is the only security control and skipping user privilege review.
• Not preparing rollback commands before changing authentication policy.

Summary

• First identify whether validate_password is installed as a plugin or component.
• Prefer lowering policy over full disablement when possible.
• Use the correct uninstall command for your mode and verify results.
• Persist only deliberate environment-specific settings.
• Keep rollback and audit trails for any security policy change.