<p>You can also use front-end form validation to enforce stronger passwords than the Craft default, either with inbuilt browser functionality using the <code>pattern</code> attribute (more on that <a href="https://developer.mozilla.org/en-US/docs/Web/HTML/Attributes/pattern" rel="nofollow noreferrer">here</a>) or JavaScript. It's not bulletproof by any means but it's an extra layer and it's the easiest way of implementing a stronger password policy for registering users.</p>
<p>I've used something like this in the past:</p>
<pre><code>&lt;input type=&quot;password&quot; name=&quot;password&quot; pattern=&quot;/^(?=.*?[a-zA-Z])(?=.*?[0-9])(?=.*?([^\w\s]|[_])).{10,}$/&quot; required&gt;
</code></pre>
<p>That regex enforces at least 10 characters, with at least one number and one symbol. You can tweak that to suit, but it helps ensure your user's passwords aren't particularly weak.</p>
<p>If you want to go further and create a more robust solution, you could create a simple module to listen to the <code>beforeSave</code> event for a User, and apply the same regex there in PHP as well. I realise that's a more involved solution and not all developers working with Craft are able and willing to create custom modules and dive into PHP, but I'm happy to throw a code example up if it helps.</p>

CC BY-SA 4.0
2021-02-24T09:22:05.063Z
2021-02-24T09:22:05.063Z
Martin Spain
<p>AFAIK, there’s no current first-party policy enforcements, but there is <a href="https://plugins.craftcms.com/password-policy" rel="nofollow noreferrer">this plugin</a> we’ve used in the past to make sure passwords aren’t easily guessed or previously pwned. I would give it a go in the meantime.</p>

CC BY-SA 4.0
2021-02-24T04:50:40.630Z
Thanks, I did look into this, but there was nothing in the documentation on how to implement it in the template or backend code. Is there a reference you can point me to?
Darthrizen
CC BY-SA 4.0
2021-02-24T00:51:44.863Z
2021-02-24T00:51:44.863Z
Christopher Kennedy-Nuñez
<p>You can add additional password complexity/requirement logic with a custom plugin/module by listening to the <code>EVENT_BEFORE_VALIDATE</code> on the User class.</p>
<p>There is an example of that for Craft 3 here: <a href="https://craftcms.stackexchange.com/a/12166/57">https://craftcms.stackexchange.com/a/12166/57</a></p>

CC BY-SA 4.0
2021-02-26T04:13:08.407Z
2021-02-26T04:13:08.407Z
Brad Bell
<p>I am having a real hard time understanding why there is not a way to control the password strength of a front-end user registration form. With Craft 3, are there no settings anywhere to control this? I have a project that would include Craft Commerce to handle subscription payments, and during the subscribe portion, the user would need to register first. It seems so strange that a user can register with a weak password.</p>

<password>
How to require stronger passwords?
# How to require stronger passwords?

(Asked by: username_0 on 2021-02-23)

I am having a real hard time understanding why there is not a way to control the password strength of a front-end user registration form. With Craft 3, are there no settings anywhere to control this? I have a project that would include Craft Commerce to handle subscription payments, and during the subscribe portion, the user would need to register first. It seems so strange that a user can register with a weak password.

**Tags:** password

---

## 3 answers

### Answer by username_1 on 2021-02-24. Score: 1

You can also use front-end form validation to enforce stronger passwords than the Craft default, either with inbuilt browser functionality using the pattern attribute (more on that here) or JavaScript. It's not bulletproof by any means but it's an extra layer and it's the easiest way of implementing a stronger password policy for registering users.
I've used something like this in the past:


That regex enforces at least 10 characters, with at least one number and one symbol. You can tweak that to suit, but it helps ensure your user's passwords aren't particularly weak.
If you want to go further and create a more robust solution, you could create a simple module to listen to the beforeSave event for a User, and apply the same regex there in PHP as well. I realise that's a more involved solution and not all developers working with Craft are able and willing to create custom modules and dive into PHP, but I'm happy to throw a code example up if it helps.


---

### Answer by username_2 on 2021-02-24. Score: 1

AFAIK, there’s no current first-party policy enforcements, but there is [this plugin](https://plugins.craftcms.com/password-policy) we’ve used in the past to make sure passwords aren’t easily guessed or previously pwned. I would give it a go in the meantime.

> **Comments:**
> **username_0**: Thanks, I did look into this, but there was nothing in the documentation on how to implement it in the template or backend code. Is there a reference you can point me to?  

---

### Answer by username_3 on 2021-02-26. Score: 0

You can add additional password complexity/requirement logic with a custom plugin/module by listening to the `EVENT_BEFORE_VALIDATE` on the User class.

There is an example of that for Craft 3 here: <https://craftcms.stackexchange.com/a/12166/57>


---

