Answers.Body: <p><strong>Craft 2</strong>:</p>
  
  <p>By default Craft enforces a 6 character minimum as the only password requirement, but as of <a href="http://buildwithcraft.com/updates#build2615" rel="nofollow noreferrer">Craft 2.3</a>, a plugin can now listen for the <a href="http://buildwithcraft.com/docs/plugins/events-reference#users-onBeforeSetPassword" rel="nofollow noreferrer">users.onBeforeSetPassword</a> event to enforce any password requirements it wants for newly set/changed passwords and set <code>$performAction = false</code> to cancel the action with any validation errors returned on the UserModel.</p>
  
  <p><strong>Craft 3</strong>:</p>
  
  <p>This has changed quite a bit for Craft 3... here is how you would pull it off:</p>
  
  <pre><code>use craft\elements\User;
  use yii\base\Event;
  use yii\base\ModelEvent;
  
  Event::on(User::class, User::EVENT_BEFORE_VALIDATE, function(ModelEvent $event) {
      /** @var User $user */
      $user = $event-&gt;sender;
  
      if ($user-&gt;newPassword !== null) {
          $validates = $this-&gt;validateNewPassword($user-&gt;newPassword);
  
          if (!$validates) {
              $user-&gt;addError('newPassword', Craft::t('plugin-handle', 'Invalid password'));
              $event-&gt;isValid = false;
          }
      }
  });
  </code></pre>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-11-09T20:19:11.630Z
Answers.Text: Has this changed at all in the past year? We would like to define password requirements that would apply everywhere (new user front-end registration, front-end password update form, email reset link)
Answers.UserDisplayName: John O
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-11-09T21:05:38.053Z
Answers.Text: @JohnO Indeed... updated answer.
Answers.UserDisplayName: Brad Bell
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-11-09T22:45:16.327Z
Answers.Text: Awesome, thank you!
Answers.UserDisplayName: John O
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2014-11-14T00:53:00.397Z
Answers.Text: Glad to hear we'll be able to customize this more in the future!
Answers.UserDisplayName: Ben Parizek
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2014-10-09T22:54:13.140Z
Answers.LastActivityDate: 2017-08-08T18:40:29.733Z
Answers.LastEditDate: 2017-08-08T18:40:29.733Z
Answers.UserDisplayName: Brad Bell
Body: <p>My site contains a <a href="http://buildwithcraft.com/docs/templating/user-registration-form" rel="nofollow">front-end registration form</a>. New users will be automatically activated, and can begin using their account immediately.</p>
  
  <p><strong>What password requirements exist?</strong></p>
  
  <p>I vaguely remember a 6-character minimum... Is that accurate, and are there any other requirements to be aware of?</p>
  
Tags: <templating><registration><password>
Title: What password requirements exist for new users?
ThreadText: # What password requirements exist for new users?
  
  (Asked by: username_0 on 2014-10-09)
  
  My site contains a [front-end registration form](http://buildwithcraft.com/docs/templating/user-registration-form). New users will be automatically activated, and can begin using their account immediately.
  
  **What password requirements exist?**
  
  I vaguely remember a 6-character minimum... Is that accurate, and are there any other requirements to be aware of?
  
  **Tags:** templating, registration, password
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_1 on 2014-10-09. Score: 7 | Accepted answer
  
  **Craft 2**:
  
  By default Craft enforces a 6 character minimum as the only password requirement, but as of [Craft 2.3](http://buildwithcraft.com/updates#build2615), a plugin can now listen for the [users.onBeforeSetPassword](http://buildwithcraft.com/docs/plugins/events-reference#users-onBeforeSetPassword) event to enforce any password requirements it wants for newly set/changed passwords and set `$performAction = false` to cancel the action with any validation errors returned on the UserModel.
  
  **Craft 3**:
  
  This has changed quite a bit for Craft 3... here is how you would pull it off:
  
  ```
  use craft\elements\User;
  use yii\base\Event;
  use yii\base\ModelEvent;
  
  Event::on(User::class, User::EVENT_BEFORE_VALIDATE, function(ModelEvent $event) {
      /** @var User $user */
      $user = $event->sender;
  
      if ($user->newPassword !== null) {
          $validates = $this->validateNewPassword($user->newPassword);
  
          if (!$validates) {
              $user->addError('newPassword', Craft::t('plugin-handle', 'Invalid password'));
              $event->isValid = false;
          }
      }
  });
  
  ```
  
  > **Comments:**
  > **username_3**: Glad to hear we'll be able to customize this more in the future!  
  > **username_2**: Has this changed at all in the past year? We would like to define password requirements that would apply everywhere (new user front-end registration, front-end password update form, email reset link)  
  > **username_1**: @username_2 Indeed... updated answer.  
  > **username_2**: Awesome, thank you!  
  
  ---
  
  