<p><strong>Craft 2</strong>:</p>

<p>By default Craft enforces a 6 character minimum as the only password requirement, but as of <a href="http://buildwithcraft.com/updates#build2615" rel="nofollow noreferrer">Craft 2.3</a>, a plugin can now listen for the <a href="http://buildwithcraft.com/docs/plugins/events-reference#users-onBeforeSetPassword" rel="nofollow noreferrer">users.onBeforeSetPassword</a> event to enforce any password requirements it wants for newly set/changed passwords and set <code>$performAction = false</code> to cancel the action with any validation errors returned on the UserModel.</p>

<p><strong>Craft 3</strong>:</p>

<p>This has changed quite a bit for Craft 3... here is how you would pull it off:</p>

<pre><code>use craft\elements\User;
use yii\base\Event;
use yii\base\ModelEvent;

Event::on(User::class, User::EVENT_BEFORE_VALIDATE, function(ModelEvent $event) {
    /** @var User $user */
    $user = $event-&gt;sender;

    if ($user-&gt;newPassword !== null) {
        $validates = $this-&gt;validateNewPassword($user-&gt;newPassword);

        if (!$validates) {
            $user-&gt;addError('newPassword', Craft::t('plugin-handle', 'Invalid password'));
            $event-&gt;isValid = false;
        }
    }
});
</code></pre>

CC BY-SA 3.0
2015-11-09T20:19:11.630Z
Has this changed at all in the past year? We would like to define password requirements that would apply everywhere (new user front-end registration, front-end password update form, email reset link)
John O
CC BY-SA 3.0
2015-11-09T21:05:38.053Z
@JohnO Indeed... updated answer.
Brad Bell
CC BY-SA 3.0
2015-11-09T22:45:16.327Z
Awesome, thank you!
John O
CC BY-SA 3.0
2014-11-14T00:53:00.397Z
Glad to hear we'll be able to customize this more in the future!
Ben Parizek
CC BY-SA 3.0
2014-10-09T22:54:13.140Z
2017-08-08T18:40:29.733Z
2017-08-08T18:40:29.733Z
Brad Bell
<p>My site contains a <a href="http://buildwithcraft.com/docs/templating/user-registration-form" rel="nofollow">front-end registration form</a>. New users will be automatically activated, and can begin using their account immediately.</p>

<p><strong>What password requirements exist?</strong></p>

<p>I vaguely remember a 6-character minimum... Is that accurate, and are there any other requirements to be aware of?</p>

<templating><registration><password>
What password requirements exist for new users?
# What password requirements exist for new users?

(Asked by: username_0 on 2014-10-09)

My site contains a [front-end registration form](http://buildwithcraft.com/docs/templating/user-registration-form). New users will be automatically activated, and can begin using their account immediately.

**What password requirements exist?**

I vaguely remember a 6-character minimum... Is that accurate, and are there any other requirements to be aware of?

**Tags:** templating, registration, password


---

## 1 answers

### Answer by username_1 on 2014-10-09. Score: 7 | Accepted answer

Craft 2:
By default Craft enforces a 6 character minimum as the only password requirement, but as of Craft 2.3, a plugin can now listen for the users.onBeforeSetPassword event to enforce any password requirements it wants for newly set/changed passwords and set $performAction = false to cancel the action with any validation errors returned on the UserModel.
Craft 3:
This has changed quite a bit for Craft 3... here is how you would pull it off:
use craft\elements\User;
use yii\base\Event;
use yii\base\ModelEvent;

Event::on(User::class, User::EVENT_BEFORE_VALIDATE, function(ModelEvent $event) {
    /** @var User $user */
    $user = $event->sender;

    if ($user->newPassword !== null) {
        $validates = $this->validateNewPassword($user->newPassword);

        if (!$validates) {
            $user->addError('newPassword', Craft::t('plugin-handle', 'Invalid password'));
            $event->isValid = false;
        }
    }
});

> **Comments:**
> **username_3**: Glad to hear we'll be able to customize this more in the future!  
> **username_2**: Has this changed at all in the past year? We would like to define password requirements that would apply everywhere (new user front-end registration, front-end password update form, email reset link)  
> **username_1**: @JohnO Indeed... updated answer.  
> **username_2**: Awesome, thank you!  

---

