I am having a real hard time understanding why there is not a way to control the password strength of a front-end user registration form. With Craft 3, are there no settings anywhere to control this? I have a project that would include Craft Commerce to handle subscription payments, and during the subscribe portion, the user would need to register first. It seems so strange that a user can register with a weak password.

3 Answers 3


AFAIK, there’s no current first-party policy enforcements, but there is this plugin we’ve used in the past to make sure passwords aren’t easily guessed or previously pwned. I would give it a go in the meantime.

  • Thanks, I did look into this, but there was nothing in the documentation on how to implement it in the template or backend code. Is there a reference you can point me to?
    – Darthrizen
    Commented Feb 24, 2021 at 4:50

You can also use front-end form validation to enforce stronger passwords than the Craft default, either with inbuilt browser functionality using the pattern attribute (more on that here) or JavaScript. It's not bulletproof by any means but it's an extra layer and it's the easiest way of implementing a stronger password policy for registering users.

I've used something like this in the past:

<input type="password" name="password" pattern="/^(?=.*?[a-zA-Z])(?=.*?[0-9])(?=.*?([^\w\s]|[_])).{10,}$/" required>

That regex enforces at least 10 characters, with at least one number and one symbol. You can tweak that to suit, but it helps ensure your user's passwords aren't particularly weak.

If you want to go further and create a more robust solution, you could create a simple module to listen to the beforeSave event for a User, and apply the same regex there in PHP as well. I realise that's a more involved solution and not all developers working with Craft are able and willing to create custom modules and dive into PHP, but I'm happy to throw a code example up if it helps.


You can add additional password complexity/requirement logic with a custom plugin/module by listening to the EVENT_BEFORE_VALIDATE on the User class.

There is an example of that for Craft 3 here: https://craftcms.stackexchange.com/a/12166/57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.