java 48 lines · 7 steps

Building a custom @StrongPassword validator in Spring

A custom Bean Validation annotation pairs with a validator class to enforce password complexity rules declaratively.

Explained by highlit
Spring Intermediate bean-validation annotations regex custom-constraint
1@Target({ElementType.FIELD, ElementType.PARAMETER})
2@Retention(RetentionPolicy.RUNTIME)
3@Constraint(validatedBy = StrongPasswordValidator.class)
4@Documented
5public @interface StrongPassword {
6 
7 String message() default "Password must be at least 8 characters and include upper, lower, digit, and special characters";
8 
9 int minLength() default 8;
10 
11 Class<?>[] groups() default {};
12 
13 Class<? extends Payload>[] payload() default {};
14}
15 
16public class StrongPasswordValidator implements ConstraintValidator<StrongPassword, String> {
17 
18 private static final Pattern UPPER = Pattern.compile("[A-Z]");
19 private static final Pattern LOWER = Pattern.compile("[a-z]");
20 private static final Pattern DIGIT = Pattern.compile("\\d");
21 private static final Pattern SPECIAL = Pattern.compile("[^A-Za-z0-9]");
22 
23 private int minLength;
24 
25 @Override
26 public void initialize(StrongPassword annotation) {
27 this.minLength = annotation.minLength();
28 }
29 
30 @Override
31 public boolean isValid(String value, ConstraintValidatorContext context) {
32 if (value == null) {
33 return true;
34 }
35 boolean valid = value.length() >= minLength
36 && UPPER.matcher(value).find()
37 && LOWER.matcher(value).find()
38 && DIGIT.matcher(value).find()
39 && SPECIAL.matcher(value).find();
40 
41 if (!valid && StringUtils.hasText(value)) {
42 context.disableDefaultConstraintViolation();
43 context.buildConstraintViolationWithTemplate(context.getDefaultConstraintMessageTemplate())
44 .addConstraintViolation();
45 }
46 return valid;
47 }
48}
01 / 01
STEP 01

Walkthrough

Space play ←→ step click any line
Three takeaways
  1. 1A custom constraint is two parts: the annotation declaring metadata and the validator holding the logic.
  2. 2Wiring a validator to an annotation via @Constraint(validatedBy=...) lets you validate fields declaratively anywhere.
  3. 3Returning true for null delegates presence checks to @NotNull, keeping each constraint focused on one concern.

Related explainers

ruby 
class UserAgentParser
  BROWSERS = [
    [/Edg\/([\d.]+)/, "Edge"],
    [/OPR\/([\d.]+)/, "Opera"],

Parsing user-agent strings in Ruby

regex pattern-matching lookup-tables
Intermediate 8 steps
java 
@Component
@Converter
public class EncryptedStringConverter implements AttributeConverter<String, String> {
 

Transparent column encryption in Spring & JPA

encryption aes-gcm jpa-converter
Advanced 10 steps
java 
package com.acme.billing.config;
 
import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
import org.springframework.boot.context.properties.ConfigurationProperties;

Feature-flagged beans with Spring @ConditionalOnProperty

feature-flags conditional-beans strategy-pattern
Intermediate 5 steps
java 
public static Map<String, String> parseCookieHeader(String header) {
    Map<String, String> cookies = new LinkedHashMap<>();
    if (header == null || header.isBlank()) {
        return cookies;

Parsing an HTTP Cookie header in Java

string-parsing http url-decoding
Intermediate 6 steps
java 
public class TimedSocketReader {
 
    private static final int READ_TIMEOUT_MS = 5_000;
    private static final int CONNECT_TIMEOUT_MS = 3_000;

Reading a socket with connect and read timeouts

sockets timeouts io
Intermediate 8 steps
python 
import re
from functools import total_ordering
from typing import Optional
 

Parsing and comparing semantic versions

regex operator-overloading sorting
Intermediate 7 steps

Share this explainer

Here's the card — post it anywhere.

Building a custom @StrongPassword validator in Spring — share card
Made with highlit — turn any snippet into a walkthrough like this in about a minute.
Explain your code