The most significant difference is that if you supply a password to the .create() method, it will be set verbatim on the user, and will not be usable to authenticate the user.

>>> user = User.objects.create(username="foo", password="bar")
>>> user.password
'bar'
>>> user.check_password("bar")
False

Instead, the create_user() method hashes the password argument, which is then.

>>> user = User.objects.create_user(username="foo", password="bar")
>>> user.password
'pbkdf2_sha256$120000$2pHBVu3tYYbK$ESG1nbUY2ZhEmstJ7Fzu1DioXmGYXiLw31YDkOGn9E0='
>>> user.check_password("bar")
True

See https://github.com/django/django/blob/master/django/contrib/auth/models.py#L145.

Some other 'tidying' is also done. See the rest of the function linked above.

User.objects.create_user() is a helper function that provides helpful utilities to create a user that otherwise you would have to do yourself. As per the documentation:

Creates, saves and returns a User

The username and password are set as given. The domain portion of email is automatically converted to lowercase, and the returned User object will have is_active set to True.

If no password is provided, set_unusable_password() will be called.

The extra_fields keyword arguments are passed through to the User’s __init__ method to allow setting arbitrary fields on a custom user model.

Without create_user() you could create the functionality yourself using the methods you mentioned, but it provides useful processing and utility.

create() and save() are generic methods to create a model instance. They don't do anything specific to the User model while create_user() method is specific method to create the user.

While creating user with generic methods, the value you set as a password will not be hashed.You need to do it by yourself like this.

u = User(username="username")
u.set_password("password")
u.save()

Also you can't do the same with create() method without an additional database query.

While with the create_user() the username and password are set as given and password will be hashed automatically and the returned User object will have is_active set to True

You should get the user model:

from django.contrib.auth import get_user_model
UserModel = get_user_model()
user = UserModel.objects.create(username="Mr Foo", password="bar")
user.save()

Or:

user = UserModel.objects.create_user("Mr Foo", password="bar")
user.save()

If you use create_user() you don't need to save it with save(). create_user() already saves the user to the database see: https://docs.djangoproject.com/en/4.0/topics/auth/default/