Documentation

Everything is a chain. Read .is().min(8) aloud and it means exactly what it says.

Install

$ npm install password-validator

Quick start

const PasswordValidator = require('password-validator');

// Create a schema
const schema = new PasswordValidator();

// Add properties to it
schema
  .is().min(8)                    // minimum length 8
  .is().max(100)                  // maximum length 100
  .has().uppercase()              // must have uppercase letters
  .has().lowercase()              // must have lowercase letters
  .has().digits(2)                // must have at least 2 digits
  .has().not().spaces()           // should not have spaces
  .is().not().oneOf(['Passw0rd']); // blacklist these values

schema.validate('validPASS123');   // → true
schema.validate('invalid');        // → false

The validate() method

By default validate() returns a boolean. Pass an options object to get more back.

{ list: true }

Returns an array of the rule names that failed instead of a boolean.

{ details: true }

Returns objects with the validation, its arguments, and a human message.

schema.validate('joke', { list: true });
// → [ 'min', 'uppercase', 'digits' ]

Rules reference

Every rule chains onto the schema. [count] and [description] are optional.

.digits([count])

Password must include digits — optionally at least count of them.

.letters([count])

Password must include letters — optionally at least count of them.

.lowercase([count])

Password must include lowercase letters, optionally at least count.

.uppercase([count])

Password must include uppercase letters, optionally at least count.

.symbols([count])

Password must include symbols, optionally at least count.

.spaces([count])

Password must include spaces, optionally at least count.

.min(len)

Specifies the minimum length of the password.

.max(len)

Specifies the maximum length of the password.

.oneOf(list)

The password must be one of the whitelisted values in list.

.not([regex])

Inverts the result of the validations applied next.

.is()

Inverts the effect of not() — reads naturally as a positive rule.

.has([regex])

Inverts not() and optionally applies a regex to the check.

.usingPlugin(fn)

Runs a custom function and folds its result into validation.