InputfieldPassword

Constructor defaults include type='password', size=30, maxlength=256, and minlength=6.

Password character-class requirements:

Old-password requirement constants:

render() outputs the new-password input, confirmation input, live strength feedback markup, and optionally an old-password input or show/hide toggle.

$f = $modules->get('InputfieldPassword');
$f->name = 'pass';
$f->unmask = true;
echo $f->render();

When showPass is false, the new-password input value is cleared during render so existing passwords are not exposed in markup. The value is restored to the Inputfield object after rendering.

When requireOld > 0 and the current user is logged in, render() also outputs an old-password input named "_old_$name".

renderValue() returns masked output by default:

$f->value = 'secret';
echo $f->renderValue(); // <p>******</p>

If showPass is true, the actual value is entity-encoded and rendered instead.

Processes submitted password and confirmation values. The confirmation input name is the main name prefixed with _.

$f = $modules->get('InputfieldPassword');
$f->name = 'pass';
$input = new WireInputData([
    'pass' => 'GoodPass123!',
    '_pass' => 'GoodPass123!',
]);
$f->processInput($input);

Processing checks:

• required password presence
• old-password match when requireOld > 0 and a user is logged in
• new/confirm password match
• isValidPassword() requirements

On any error, the value is cleared and change tracking is reset.

Validates a candidate password against invalid whitespace, minimum length, and configured character-class requirements. Returns true when valid and records errors when invalid.

if(!$f->isValidPassword('abc')) {
    foreach($f->getErrors() as $error) {
        echo $sanitizer->entities($error);
    }
}

requireNone skips only the character-class checks. Minimum length and invalid tab/newline whitespace are still enforced.

Associates the input with a page being edited. When the page is unpublished, the password field becomes required. Later attempts to set collapsed are forced to Inputfield::collapsedNo so an initial password field stays visible.

$f->setPage($userPage);

getConfigInputfields() removes several inherited text-input settings from the config UI and exposes password-specific settings:

• requirements
• complexifyBanMode
• complexifyFactor
• minlength
• showPass for standalone usage
• requireOld
• unmask

• Access this inputfield with $modules->get('InputfieldPassword').
• The class validates password input but does not hash or persist passwords. Persistence is handled by password fieldtypes and user password APIs.
• Client-side strength feedback depends on bundled JavaScript, but server-side validation still runs without it.
• Browser autofill is discouraged by rendering autocomplete="new-password" in admin/logged-in contexts.
• The module is permanent and cannot be uninstalled.

Source file: wire/modules/Inputfield/InputfieldPassword/InputfieldPassword.module