Enforce password

app.py

@@ -167,6 +167,20 @@ def allowed_file(filename):
     return "." in filename and filename.rsplit(".", 1)[1].lower() in ALLOWED_EXTENSIONS
 
 
+def validate_password_strength(password):
+    checks = [
+        (len(password) >= 10, "at least 10 characters"),
+        (any(char.islower() for char in password), "one lowercase letter"),
+        (any(char.isupper() for char in password), "one uppercase letter"),
+        (any(char.isdigit() for char in password), "one number"),
+        (any(not char.isalnum() for char in password), "one special character"),
+    ]
+    missing = [message for valid, message in checks if not valid]
+    if missing:
+        return "Password must contain " + ", ".join(missing) + "."
+    return None
+
+
 def extension_from_url(url, content_type):
     path = urlparse(url).path
     if "." in path:
@@ -269,8 +283,8 @@ def register():
             flash("All fields are required.", "danger")
         elif password != confirm_password:
             flash("Passwords do not match.", "danger")
-        elif len(password) < 6:
-            flash("Password must contain at least 6 characters.", "danger")
+        elif validate_password_strength(password):
+            flash(validate_password_strength(password), "danger")
         else:
             try:
                 with get_db() as conn:

templates/register.html

@@ -19,7 +19,16 @@
 
   <label class="cyber-field">
     <span>Password</span>
-    <input type="password" name="password" required autocomplete="new-password" placeholder="Minimum 6 characters">
+    <input
+      type="password"
+      name="password"
+      required
+      minlength="10"
+      pattern="(?=.*[a-z])(?=.*[A-Z])(?=.*\d)(?=.*[^A-Za-z0-9]).{10,}"
+      autocomplete="new-password"
+      placeholder="10+ chars, Aa, 1, symbol"
+      title="Use at least 10 characters with uppercase, lowercase, number, and special character">
+    <small class="password-rules">Use 10+ characters with uppercase, lowercase, number, and special character.</small>
   </label>
 
   <label class="cyber-field">