diff --git a/plugins/User/plugin.py b/plugins/User/plugin.py
index d4d34303f..2656dc5a0 100644
--- a/plugins/User/plugin.py
+++ b/plugins/User/plugin.py
@@ -110,6 +110,7 @@ class User(callbacks.Plugin):
         user, or use the identify command to identify just for a session.
         This command (and all other commands that include a password) must be
         sent to the bot privately, not in a channel.
+        Use "!" instead of <password> to disable password authentication.
         """
         addHostmask = True
         try:
@@ -132,9 +133,17 @@ class User(callbacks.Plugin):
                 return
         except KeyError:
             pass
+
+        if password == "!":
+            password = None
+        elif len(password) < 3:
+            irc.error(_('The password must be at least 3 characters long.'),
+                    Raise=True)
+
         user = ircdb.users.newUser()
         user.name = name
-        user.setPassword(password)
+        if password:
+            user.setPassword(password)
         if addHostmask:
             user.addHostmask(msg.prefix)
         ircdb.users.setUser(user)
diff --git a/plugins/User/test.py b/plugins/User/test.py
index a9e8d1345..bca688837 100644
--- a/plugins/User/test.py
+++ b/plugins/User/test.py
@@ -105,6 +105,14 @@ class UserTestCase(PluginTestCase):
         m = self.irc.takeMsg()
         self.assertFalse(m is not None, m)
 
+    def testRegisterPasswordLength(self):
+        self.assertRegexp('register foo aa', 'at least 3 characters long.')
+
+    def testRegisterNoPassword(self):
+        self.assertNotError('register foo !')
+        self.assertRegexp('identify foo bar', 'your password is wrong.')
+        self.assertRegexp('identify foo !', 'your password is wrong.')
+
     def testRegisterUnregister(self):
         self.prefix = self.prefix1
         self.assertNotError('register foo bar')
diff --git a/src/ircdb.py b/src/ircdb.py
index 4c866a8b6..85b000797 100644
--- a/src/ircdb.py
+++ b/src/ircdb.py
@@ -251,16 +251,19 @@ class IrcUser(object):
             return self.capabilities.check(capability, ignoreOwner=ignoreOwner)
 
     def setPassword(self, password, hashed=False):
-        """Sets the user's password."""
+        """Sets the user's password. If password is None, it will be disabled."""
         if hashed or self.hashed:
             self.hashed = True
-            self.password = utils.saltHash(password)
+            if password is None:
+                self.password = ""
+            else:
+                self.password = utils.saltHash(password)
         else:
             self.password = password
 
     def checkPassword(self, password):
         """Checks the user's password."""
-        if password is None:
+        if password is None or not self.password:
             return False
         if self.hashed:
             (salt, _) = self.password.split('|')