Use the ChangePassword.NewPasswordRegularExpression property to define the requirements for passwords that are used to validate user accounts on your Web site. This regular expression is used to enforce password rules on the client side. The ChangePassword.NewPasswordRegularExpression is not related to the password enforcement that can be configured at the data store level. The password must meet the minimum requirements set by the membership provider in the System.Web.Security.Membership.MinRequiredPasswordLength, System.Web.Security.Membership.MinRequiredNonAlphanumericCharacters, and System.Web.Security.Membership.PasswordStrengthRegularExpression properties. If the password does not meet these requirements, the ChangePassword.ChangePasswordError event is raised.

To display requirements to the user, set the ChangePassword.PasswordHintText property.

If the password entered does not pass the regular expression contained in the ChangePassword.NewPasswordRegularExpression property, the text contained in the ChangePassword.NewPasswordRegularExpressionErrorMessage property is displayed to the user.

If the password is rejected by the membership provider, the text contained in the ChangePassword.ChangePasswordFailureText property is displayed.

A common use of password standards is to force users to select strong passwords. As a best practice, enforce password rules at the data level in the membership provider. The ChangePassword.NewPasswordRegularExpression property allows for the convenience of checking the password on the client side, but does not lock out users who make repeated attempts to log on. To improve security, configure your membership provider to restrict the number of attempts a user may make to log on. For more information, see Securing Membership.