Set Minimum Password Length Firebase Email & Password Authentication

Question

When using Firebase's Email & Password setting it seems like there are no security constraints on the password.

For example I could create the following user:

firebaseRef.createUser(
{
    email: "[email protected]",
    password: "j"
});

I'd like to at least set a minimum password length. Does firebase provide a way to do this?

Frank van Puffelen · Accepted Answer · 2024-03-08 17:23:09Z

32

Update (2024): for Firebase projects that have upgraded to Identity Platform, you can now set the minimal password length (and other requirements). Check out the documentation on password policies.

Old answer below, just kept for reference.

The below answer is outdated, check above for the latest 👆

There is currently no way to configure a minimum password length or strength for Firebase email+password Authentication.

You could build such a restriction into your app, but tech-savvy users can bypass that by calling the API. Or you could introduce a "isPasswordApproved" flag that only a server-side process can set, and then validate the password strength there. But neither of these sound very appealing.

edited Mar 8, 2024 at 17:23

answered Mar 30, 2016 at 21:00

Frank van Puffelen

603k85 gold badges895 silver badges869 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Skoempie · Accepted Answer · 2016-11-30 08:48:38Z

32

A FirebaseAuthWeakPasswordException is thrown when using a weak password (less than 6 chars) to create a new account or to update an existing account's password. Use getReason() to get a message with the reason the validation failed that you can display to your users.

See https://firebase.google.com/docs/reference/android/com/google/firebase/auth/FirebaseAuthWeakPasswordException for more details.

answered Nov 30, 2016 at 8:48

Skoempie

1,19110 silver badges18 bronze badges

2 Comments

Sam Chen Over a year ago

String reason = ((FirebaseAuthWeakPasswordException) task.getException()).getReason();

Sam Chen Over a year ago

In fact, just use task.getException().getMessage() also works as expected.

eddyP23 · Accepted Answer · 2019-02-12 13:59:12Z

15

I would argue that implementing front-end validation here should be enough (at least in a big portion of applications).

If the purpose of this validation is to protect the user himself, then there is no harm in allowing a user to hack your app and set the password to password, go to a forum and post the credentials, and jump out of a window.

answered Feb 12, 2019 at 13:59

eddyP23

6,96312 gold badges59 silver badges99 bronze badges

1 Comment

Ramtin Soltani Over a year ago

The thing is the user can do a password reset and set a new password with no validation done by the app there (unless a custom auth handler is used).

user13526097 · Accepted Answer · 2020-05-12 13:27:57Z

3

The problem is with the Reset Password form that Firebase sends. It would be nice to use it and not have to build this out as well.

answered May 12, 2020 at 13:27

user13526097

311 bronze badge

1 Comment

Stefan Over a year ago

You can customize the reset password form and navigate the user to a custom URL. From there you can handle custom logic/backend calls etc.: firebase.google.com/docs/auth/custom-email-handler

Collectives™ on Stack Overflow

Set Minimum Password Length Firebase Email & Password Authentication

4 Answers 4

Comments

2 Comments

1 Comment

1 Comment

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

4 Answers 4

Comments

2 Comments

1 Comment

1 Comment

Your Answer

Sign up or log in

Post as a guest

Linked

Related