Custom form password validation / strength enforcement

Question

I have a custom form that would create user. The form is rendered with Form API and is using PasswordConfirm element, but it doesn't seem to validate the password against the default password rules (e.g. number of characters, combinations of characters).

How do I apply the default Drupal password rules to my custom form's password confirm field in the form validation method?

Answer 1

Built in is only recommendation. But there are several contrib modules like https://www.drupal.org/project/password_policy

Use such a module.

If you have created your own custom form, just use the usual

public function validateForm(array &$form, FormStateInterface $form_state)

method to implement your rules.