Description of the need
I would like a simple way to enforce more secure passwords in Backdrop core. Since a longer password is a stronger password, I would like a minimum length setting for passwords.
Proposed solution
An admin sets a minimum length for passwords
When a password is created that does not meet that minimum, a validation error is thrown asking for a longer one.
Alternatives that have been considered
This a follow up to https://github.com/backdrop/backdrop-issues/issues/4265, where at some point a minimum password length setting was added as a factor in password strength. Both @stpaultim and I recognized it as its own setting, and were surprised when setting a minimum password length still allowed passwords to be created that did not meet the minimum.
Through discussion we realized that the setting we saw -- and that I loved! -- was not intended to be used as a control on allowed password length.
I'm creating this new issue because I still want a password minimum length
feature for Backdrop core.
Recent comments
I think given the warning on the source site: At this time, if your new project can afford to require PHP 5.5+, which it should, please use PHP's native password_hash() /...
July 31, 2025
I did a very quick test and if the Display format of the webform submission value is HTML then it appears but if plain text then it doesn't, so something is included regardless of if empty when...
"Hide rewriting if empty" has no effect
Just to clarify it appears that the item: Fix Search for "On the Web" module, is about the search on backdropcms.org at https://backdropcms.org/modules
July 31, 2025