Password Policy on Signup
Apply password requirements from the very first account-creation step
The auth_password_policy_signup module extends the signup page so new users can see password requirements before the account is created.
The goal is to block weak passwords at signup time instead of waiting until after the account already exists.
Key features
Key points
• Show password requirements directly on the signup form.
• Validate the password before the new account is created.
• Support a password strength meter so users can improve the password themselves.
• Keep policy behavior aligned between signup and password-change flows.
Register a new account
Steps
1. Open the signup page, usually /web/signup.
2. Enter the name and email address.
3. Enter the new password.
4. Review the requirement message such as “Password must be at least 8 characters”.
5. Check the color or score shown by the password strength meter.
6. Submit the form only after the password meets the minimum policy.
Password strength meter
The strength meter helps users understand whether the current password is weak, medium, or strong, but it is still a visual guide.
The actual required rule still comes from the configured minimum password policy.
Common rating levels
| Level | Indicator | Meaning |
|---|---|---|
| Weak | Red color or low percentage | Password is too short or too simple. |
| Medium | Yellow color | Longer password, but still limited in character variety. |
| Strong | Green color | Longer password with better complexity. |
What affects password strength?
Key points
• Password length.
• Combination of uppercase and lowercase letters.
• Numbers.
• Special characters.
Important notes
Key points
• The module auto-installs when both auth_password_policy and auth_signup are available.
• Signup rules should match password-change rules to avoid inconsistent user experience.
• The strength meter is only guidance; the actual blocking rule comes from the configured policy.
• If the password is too short, signup submission may be blocked.