I'm making an open-source web app that has login stuff in it.

I want to check on the server if the password is 'secure' (at least 8 characters, etc.).

The thing is that I'm not sure if I need something more than check for:

  • at least 8 characters.
  • uses numbers/special characters.
  • 1
    That depends on your security requirements and can't be answered definitively. We have lots of password-related questions here that might help you further.
    – Arminius
    Commented Aug 29, 2017 at 22:35
  • Can you have provide a little more information such as OS Type, server password role etc?
    – Joe
    Commented Aug 29, 2017 at 22:39
  • 2
    Terminology: I believe you wish to check to see if a password is strong (not secure).
    – John Wu
    Commented Aug 29, 2017 at 23:03
  • @Joe Whoops, I didnt really specify what I was talking about. See the edits
    – v0idifier
    Commented Aug 29, 2017 at 23:29
  • 8 character doesn't prevent dictionary attacks and pwned passwords
    – Xaqron
    Commented Aug 30, 2017 at 0:10

1 Answer 1


If not mistaken, you are asking how strong the server password(s) should be. As said in the comments, you are the only one who can answer that.

Those pages should help you out:





Not in the question range

Your password(s) policies should meet the security requirements you have wisely established after assessed the risks. Here is a basic plain scheme :

        0 security           security requirements button        super secure
user super friendly                                               Not user friendly at all

Here is the general idea : you have to define the security requirements button position. It's more or less a compromise between the ease of access and the security.

Not the answer you're looking for? Browse other questions tagged .