My site contains a front-end registration form. New users will be automatically activated, and can begin using their account immediately.

What password requirements exist?

I vaguely remember a 6-character minimum... Is that accurate, and are there any other requirements to be aware of?


Craft 2:

By default Craft enforces a 6 character minimum as the only password requirement, but as of Craft 2.3, a plugin can now listen for the users.onBeforeSetPassword event to enforce any password requirements it wants for newly set/changed passwords and set $performAction = false to cancel the action with any validation errors returned on the UserModel.

Craft 3:

This has changed quite a bit for Craft 3... here is how you would pull it off:

use craft\elements\User;
use yii\base\Event;
use yii\base\ModelEvent;

Event::on(User::class, User::EVENT_BEFORE_VALIDATE, function(ModelEvent $event) {
    /** @var User $user */
    $user = $event->sender;

    if ($user->newPassword !== null) {
        $validates = $this->validateNewPassword($user->newPassword);

        if (!$validates) {
            $user->addError('newPassword', Craft::t('plugin-handle', 'Invalid password'));
            $event->isValid = false;
  • Glad to hear we'll be able to customize this more in the future! – Ben Parizek Nov 14 '14 at 0:53
  • Has this changed at all in the past year? We would like to define password requirements that would apply everywhere (new user front-end registration, front-end password update form, email reset link) – John O Nov 9 '15 at 20:19
  • @JohnO Indeed... updated answer. – Brad Bell Nov 9 '15 at 21:05
  • Awesome, thank you! – John O Nov 9 '15 at 22:45

This site is temporarily in read only mode and not accepting new answers.

Not the answer you're looking for? Browse other questions tagged .