Challenge 1 / 2

We tried correcthorsebatterystaple - long, four whole words - and PasswordStrength was perfectly happy with it. But the form rejected it anyway:

This password has been leaked in a data breach, it must not be used.

How can a password be strong and rejected?

Four lowercase words can't score above STRENGTH_WEAK - the strength error was just hidden behind the breach error.

NotCompromisedPassword runs first and short-circuits the rest, so the strength score was never actually calculated.

The two constraints measure completely different things: PasswordStrength does math on the password itself, while NotCompromisedPassword asks whether it has turned up in a real breach - and that particular phrase very much has.

PasswordStrength only looks at length, so any password of 12 characters or more sails past it.

Rewatch the video