I would like to increase password security for customer and admin accounts in Magento. In addition to minimum password length, contain uppercase, lowercase, special characters, and digits.

I found the JavaScript file that controls the validation. Path:js/prototype/validation.js (Screenshot and code attached) What is the appropriate code to be added?

enter image description here

 ['validate-password', 'Please enter 8 or more characters. Leading or trailing spaces will be ignored.', function(v) {
            var pass=v.strip(); /*strip leading and trailing spaces*/
            return !(pass.length>0 && pass.length < 8);
['validate-admin-password', 'Please enter 7 or more characters. Password should contain both numeric and alphabetic characters.', function(v) {
            var pass=v.strip();
            if (0 == pass.length) {
                return true;
            if (!(/[a-z]/i.test(v)) || !(/[0-9]/.test(v))) {
                return false;
            return !(pass.length < 7);

Thank you in advance for your help.


You can use below regular expression.


Explanation of this expression is

(?=.*\d)                //should contain at least one digit
(?=.*[a-z])             //should contain at least one lower case
(?=.*[A-Z])             //should contain at least one upper case
[a-zA-Z0-9]{8,}         //should contain at least 8 from the mentioned characters

You can replace line

 return !(pass.length>0 && pass.length < 8);


if (!(/^(?=.*[0-9])(?=.*[a-z])(?=.*[A-Z])([a-zA-Z0-9]{8,})$/.test(pass))) {
        return false;
return true;

And change error message related to expression. You can do same for admin password.

For special character you can use below regular expression.

Minimum 8 characters at least 1 Uppercase Alphabet, 1 Lowercase Alphabet, 1 Number and 1 Special Character from amongst these $@$!%*?&#^ .


You can use it like this way

if (!(/^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)(?=.*[$@$!%*?&#^])([A-Za-z\d$@$!%*?&#^]{8,})$/.test(pass))) {
     return false;
return true;
  • Thank you Akhilesh. How can we incorporate the special characters as well?
    – Elvis
    Sep 24 '15 at 21:08
  • I have edited my answer for special characters. Sep 26 '15 at 2:48
  • Thanks bro! Take my Upvote!!!
    – rupi
    Jul 23 '19 at 10:41

Please note that if you wish to use the "Send Auto Generated Password" found in the customers admin page you will need to update the "generatePassword" function found in "app/code/core/Mage/Customer/Model/Customer.php". Obvs, copy this file to the local folder before making changes. This is the code that I am now using for this function:

public function generatePassword($length = 14)
        $char_upper = array('A','B','C','D','E','F','G','H','I','J','K','L','M','N','O','P','Q','R','S','T','U','V','W','X','Y','Z');
        $char_lower = array('a','b','c','d','e','f','g','i','j','k','l','m','n','o','p','q','r','s','t','u','v','w','x','y','z');
        $char_num = array('0','1','2','3','4','5','6','7','8','9');
        $char_special = array('$','@','$','!','%','*','?','&','#','^');
        $chars_new = array();

        $char_upper_rand = array_rand(array_flip($char_upper), 2);
        $chars_new = array_merge($chars_new, $char_upper_rand);

        $char_lower_rand = array_rand(array_flip($char_lower), 8);
        $chars_new = array_merge($chars_new, $char_lower_rand);

        $char_num_rand = array_rand(array_flip($char_num), 2);
        $chars_new = array_merge($chars_new, $char_num_rand);

        $char_special_rand = array_rand(array_flip($char_special), 2);
        $chars_new = array_merge($chars_new, $char_special_rand);

        $final_chars = implode($chars_new);
        return Mage::helper('core')->getRandomString($length, $final_chars);

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.