diff --git a/openedx/core/djangoapps/password_policy/forms.py b/openedx/core/djangoapps/password_policy/forms.py
index 389669c370e1..7651583053b7 100644
--- a/openedx/core/djangoapps/password_policy/forms.py
+++ b/openedx/core/djangoapps/password_policy/forms.py
@@ -6,6 +6,7 @@
 from django.forms import ValidationError
 
 from openedx.core.djangoapps.password_policy import compliance as password_policy_compliance
+from openedx.core.djangolib.markup import HTML
 
 
 class PasswordPolicyAwareAdminAuthForm(AdminAuthenticationForm):
@@ -24,9 +25,9 @@ def clean(self):
                 password_policy_compliance.enforce_compliance_on_login(self.user_cache, cleaned_data['password'])
             except password_policy_compliance.NonCompliantPasswordWarning as e:
                 # Allow login, but warn the user that they will be required to reset their password soon.
-                messages.warning(self.request, str(e))
+                messages.warning(self.request, HTML(str(e)))
             except password_policy_compliance.NonCompliantPasswordException as e:
                 # Prevent the login attempt.
-                raise ValidationError(str(e))  # lint-amnesty, pylint: disable=raise-missing-from
+                raise ValidationError(HTML(str(e)))  # lint-amnesty, pylint: disable=raise-missing-from
 
         return cleaned_data
diff --git a/openedx/core/djangoapps/user_authn/views/login.py b/openedx/core/djangoapps/user_authn/views/login.py
index 9d47e2bc7ee3..3c59f818a4eb 100644
--- a/openedx/core/djangoapps/user_authn/views/login.py
+++ b/openedx/core/djangoapps/user_authn/views/login.py
@@ -149,7 +149,7 @@ def _enforce_password_policy_compliance(request, user):  # lint-amnesty, pylint:
         password_policy_compliance.enforce_compliance_on_login(user, request.POST.get('password'))
     except password_policy_compliance.NonCompliantPasswordWarning as e:
         # Allow login, but warn the user that they will be required to reset their password soon.
-        PageLevelMessages.register_warning_message(request, str(e))
+        PageLevelMessages.register_warning_message(request, HTML(str(e)))
     except password_policy_compliance.NonCompliantPasswordException as e:
         AUDIT_LOG.info("Password reset initiated for email %s.", user.email)
         send_password_reset_email_for_user(user, request)