I have a custom form that would create user. The form is rendered with Form API and is using PasswordConfirm element, but it doesn't seem to validate the password against the default password rules (e.g. number of characters, combinations of characters).

How do I apply the default Drupal password rules to my custom form's password confirm field in the form validation method?

  • I don't think Drupal does have password rules by default? It lists some recommendations, but they're just recommendations AFAIK.
    – sonfd
    Jul 2, 2021 at 13:37
  • You're right. I just started to realize this. Jul 2, 2021 at 16:17

1 Answer 1


Built in is only recommendation. But there are several contrib modules like https://www.drupal.org/project/password_policy

Use such a module.

If you have created your own custom form, just use the usual

public function validateForm(array &$form, FormStateInterface $form_state)

method to implement your rules.

  • Thanks for the answer. I played with the module for a while, but there are issues with it. I'm using the "password_policy.validator" (Drupal\password_policy\PasswordPolicyValidator) to validate the password. While it works to provide a bool result, it does not tell you what is wrong when the test fail. That is certainly a problem. Jul 2, 2021 at 15:24
  • I just extended the class to make things work for me. Thanks for the suggestion. Jul 2, 2021 at 16:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.