Personally, I think that it's not so important to check the strength of the passwords on server-side, since, if the user evades the validation on the client side, it would be their responsibility to use an insecure password; however, I don't know if this is a correct practice.

3 Answers 3


Check both so you don't waste server or network resources and you're legally covered.

Anything done client-side is just a filter to preserve resources. Repeat it on the server. There's no sense in sending a password that doesn't meet your complexity requirements. All it does it increase the user's potential exposure (e.g. perhaps they recycle passwords. You neither need nor want to see their insecure universal password).

Servers can add some stronger tests, like checking against the Have I Been Pwned database.

If you're vetting entirely client-side and they bypass the protections, there may be unsavory legal consequences after a breach (though I'm not a lawyer and this isn't the right place for such advice).


... if the user evades the validation on the client side, it would be their responsibility to use an insecure password ...

I follow this argument somewhat if only the users data itself are at risk or if the user is fully liable for any damage done if something goes wrong. But this is rarely the case.

It is clearly not the case in companies, since here are company data at risk and usually the user has also limited liability. But even with personal mail accounts the problem is already visible: there is a reputation and trust connected with a specific mail address and this can be misused with a compromised account for example in supply chain attacks.

Thus, I'm not accepting that one should not enforce good password hygiene and just leave it to the user, since in most cases the user can not be taken fully responsible and liable for any damage done due to weak passwords.


Really you should validate on both, client side is the more user friendly way of doing it using JavaScript. Although yes it is the users responsibility, it can leave you with issues further down the line as the website/server owner. For example if you have people starting to crack user accounts they can be used for spam or spreading malware etc to other users or even administrators.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .