Fixed #27045 -- Documented that AUTH_PASSWORD_VALIDATORS aren't applied at the model level.

1 files changed, 7 insertions, 1 deletions

diff --git a/docs/topics/auth/passwords.txt b/docs/topics/auth/passwords.txt
index 770303ac2d..41a908d2d3 100644
--- a/docs/topics/auth/passwords.txt
+++ b/docs/topics/auth/passwords.txt
@@ -461,11 +461,17 @@ meet the requirements, and optionally receive passwords that have been set.
 Validators can also have optional settings to fine tune their behavior.
 
 Validation is controlled by the :setting:`AUTH_PASSWORD_VALIDATORS` setting.
-By default, validators are used in the forms to reset or change passwords.
 The default for the setting is an empty list, which means no validators are
 applied. In new projects created with the default :djadmin:`startproject`
 template, a simple set of validators is enabled.
 
+By default, validators are used in the forms to reset or change passwords and
+in the :djadmin:`createsuperuser` and :djadmin:`changepassword` management
+commands. Validators aren't applied at the model level, for example in
+``User.objects.create_user()`` and ``create_superuser()``, because we assume
+that developers, not users, interact with Django at that level and also because
+model validation doesn't automatically run as part of creating models.
+
 .. note::
 
     Password validation can prevent the use of many types of weak passwords.