Password regex limitations

[damianstasik]

It should allow the user to type in whatever he/she wants. Why? Because they might be using password generators and this regex:

/^[a-zA-Z0-9+_-]{6,18}$/

... is limiting them to use only a small subset of characters and that is not a good practice. I think it should also allow to type in longer text, instead of 18, I would use for example 32.

[lukehaas]

Thanks, you're right, I've been intending to make this more flexible.

[RobThree]

What about !@#$%^&*()={};:'"<>,./\?~ or space, or 💩 or ☃? Why restrict a password to anything at all (maybe just a lower limit on length...)

[lukehaas]

Password regex is now removed