Django Password Input Feedback Proposal

Based on the Django documentation, I can provide some context about the current behavior of the createsuperuser and changepassword management commands and considerations for your proposal.

Current Behavior

Django's authentication system prioritizes security by:

1. Storing only password hashes, not raw passwords
2. Using the Python getpass module which intentionally hides password input
3. Implementing password validation through AUTH_PASSWORD_VALIDATORS

The createsuperuser command has a feature that allows bypassing password validation checks, which shows Django's flexibility in balancing security with usability in certain contexts.

Considerations for Your Proposal

Your proposal to add visual feedback during password entry raises some important considerations:

Security Implications

Displaying passwords in plain text (option #3) could potentially expose sensitive information to onlookers, which contradicts standard security practices for password entry.

Usability Benefits

You make a valid point about user experience, especially for beginners. The fact that Django Girls tutorial needs to explicitly explain the lack of visual feedback indicates this is a common point of confusion.

Implementation Options

Of your proposed solutions:

1. Waiting for Python's getpass to be updated is not a reliable path forward
2. Implementing asterisk feedback in Django (option #2) would be more aligned with common security practices than showing plain text
3. Showing plain text (option #3) offers maximum usability but with security tradeoffs

Recommendation

If you're considering contributing to Django, option #2 (implementing asterisk feedback) would likely be more acceptable from a security perspective while still addressing the usability concerns. This approach:

1. Maintains some level of password obscurity
2. Provides the visual feedback beginners expect
3. Aligns with common patterns in other command-line tools

You might consider implementing this as an optional feature that could be enabled/disabled through a configuration setting, similar to how Django handles other security vs. usability tradeoffs.

If you decide to pursue this change, you would need to create a custom implementation that replaces or extends the current password input mechanism while maintaining compatibility with Django's existing authentication framework.