Password Input
Enter a password with a visibility toggle, optional strength meter and requirements checklist.
import { PasswordInput, PasswordRequirement, PasswordRequirements, PasswordStrength, PasswordStrengthResult } from '@youj/react'
Installation & usage
npm i @youj/reactFor an app already set up with npx @youj/cli init, which installs the peers (@youj/core, @youj/motion, motion and Base UI) and wires the provider. New app? Start at Installation.
Use it for every password: signing in, choosing a new one, confirming a change. PasswordInput alone is enough for a sign-in form. When people choose a password, add PasswordStrength and PasswordRequirements under it in the same Field, so the rules and the estimate update as they type. For a one-time code sent by email or an authenticator app, use Input OTP instead.
import { useId, useState } from 'react'
import { Field, FieldLabel, PasswordInput, PasswordRequirements, PasswordStrength } from '@youj/react'
export function NewPassword() {
const [value, setValue] = useState('')
const rulesId = useId()
return (
<Field>
<FieldLabel>New password</FieldLabel>
<PasswordInput autoComplete="new-password" value={value} onValueChange={setValue} aria-describedby={rulesId} />
<PasswordStrength value={value} />
<PasswordRequirements id={rulesId} value={value} />
</Field>
)
}autoComplete defaults to current-password. Set new-password when people choose one, so password managers offer to generate it. Point the input's aria-describedby at the checklist's id so the rules are read with the field.
Description
A change-password card: the new password gets a strength meter and a requirements checklist, and the confirmation checks that the two match.
PasswordRequirements ticks each rule as the password meets it, with a drawn check. The defaults are defaultPasswordRequirements: at least eight characters, upper and lower case, a number and a symbol. Pass requirements as { label, test } pairs for your own, and reuse the same list to decide when the form can submit, as the demo does.
The visibility toggle.
The eye button shows the password as text and hides it again. Pressing it with a pointer keeps focus and the caret in the field, so people can check a character mid-word and carry on typing. visible, defaultVisible and onVisibleChange control it from outside. While Caps Lock is on, a quiet mark sits beside the eye and screen readers hear it once.
The strength meter as a password gets stronger.
PasswordStrength is a meter in four segments that fill from the inline start and tint from danger to success. The built-in estimate weighs length and character variety against common passwords, runs (abc, 321) and repeats (aaa), and keeps anything under eight characters weak however varied it is. It's also exported on its own as scorePassword.
A strength meter using a scorer of your own.
Pass scorer for your own policy or a thorough estimator such as zxcvbn or a server check. It returns a 0 to 4 score, or { score, label } to name the step. labels renames all five steps, very weak to strong.
Code
password-input-demo.tsx, the Demo story. The component itself comes from the package.
Reference
Propsvisible, defaultVisible, onVisibleChange… (10)
Props
| Prop | Type | |
|---|---|---|
visible | booleanControlled visibility. | – |
defaultVisible | booleandefault false | false |
onVisibleChange | (visible: boolean) => void | – |
autoComplete | stringdefault 'current-password' | 'current-password' |
groupClassName | stringWrapper class; | – |
Other props pass through: extends InputPrimitive.Props. | ||
className styles the input and groupClassName the group around it. Other Base UI Input props pass through, such as value, onValueChange and name.
PasswordStrength
| Prop | Type | |
|---|---|---|
valueRequired | stringThe password to score. | – |
scorer | (password: string) => number | PasswordStrengthResultYour own estimate: a 0–4 score, or | – |
labels | readonly [string, string, string, string, string]Five labels, very weak → strong. | – |
Other props pass through: extends ComponentProps<'div'>. | ||
PasswordRequirements
| Prop | Type | |
|---|---|---|
valueRequired | string | – |
requirements | PasswordRequirement[] | – |
Other props pass through: extends ComponentProps<'ul'>. | ||
MotionReveal, slash on, hide… · reduced motion
Motion
| Moment | Tokens | ||
|---|---|---|---|
| Revealthe eye blinks shut and open again | duration.slowease.standard340ms · cubic-bezier(0.2, 0, 0, 1) | 340mscubic-bezier(0.2, 0, 0, 1) | |
Slash ondrawn through the eye after a fast delay | duration.baseease.standard220ms · cubic-bezier(0.2, 0, 0, 1) | 220mscubic-bezier(0.2, 0, 0, 1) | |
| Hidethe slash retracts and the eye settles | duration.fastease.standard140ms · cubic-bezier(0.2, 0, 0, 1) | 140mscubic-bezier(0.2, 0, 0, 1) | |
| Strength segmentsfill from the inline start and tint, one stagger step apart; they empty from the far end | duration.baseease.standard220ms · cubic-bezier(0.2, 0, 0, 1) | 220mscubic-bezier(0.2, 0, 0, 1) | |
| Strength labelcolor follows the score | duration.fastease.standard140ms · cubic-bezier(0.2, 0, 0, 1) | 140mscubic-bezier(0.2, 0, 0, 1) | |
| Requirement metthe check draws on | duration.slowease.enter340ms · cubic-bezier(0.16, 1, 0.3, 1) | 340mscubic-bezier(0.16, 1, 0.3, 1) | |
Check landinga small settle after a base delay | spring.settle0.45s, bounce 0.3 | 0.45s, bounce 0.3 |
Reduced motion
The eye swaps at once, segments fill without a stagger, and checks appear already drawn.
Reduced motion
The eye swaps between open and slashed at once, the strength segments fill together with no stagger, and met requirements show their check already drawn. Every state change is still visible and announced.
AccessibilityKeyboard, ARIA, focus
Accessibility
- The reveal button is named "Show password" and reports its state with
aria-pressed. It keeps focus in the field on a pointer press, and it's a normal button for the keyboard. - Caps Lock is announced once through a polite live region when it turns on.
PasswordStrengthis ameterlabeled "Password strength" with the step's name as itsaria-valuetext. Because a meter's value isn't announced as it changes, the new step is announced politely, once per change.- Each requirement reads as "Done:" or "Not yet:" before its label, so the checklist makes sense without its icons.
autoCapitalize,autoCorrectandspellCheckare off, so a revealed password isn't changed or underlined.