Password Field

The Password field in Convert Forms enables users to enter a password securely. By default, the field includes a mask/unmask toggle, allowing users to double-check what they’ve typed without compromising security. This feature helps prevent typos while maintaining a secure input experience.

Adding a Password Input Field

To add a Password field to your form, first, open the form builder and go to the Add Field tab. Search for the Password field and click on it.

The field will be added to your form editor.

Customizing the Password Field

Like other fields, you can fully customize the Password field. You can:

• Change the Label (e.g. “Create Password”).
• Add a Placeholder.
• Make it Required.
• Adjust field size and layout.

Viewing and Editing Password Values in the Backend

For security, password values are masked in the backend by default. In both the Submissions list and the Submission edit screen, the password field will appear as hidden (••••). To view the actual password, click the mask toggle icon next to the field. This reveals the password value for administrators when needed.

Requiring the User to Confirm Their Password

When creating a new account or setting a password, it’s best practice to ask users to enter it twice. This ensures they haven’t made a typo, which can easily happen when the input is masked for security. Without a confirmation field, a user might submit the form with a mistyped password and then be locked out of their account or need to reset it immediately — which leads to frustration and lost trust. By adding a Confirmation Field (e.g. “Confirm Password”) and linking it to the original Password field, you give users a chance to verify their entry before submitting the form.

For detailed steps, see the full guide: Confirmation Field Documentation

Preventing Passwords from Being Stored in the Database

If you don’t want password values to be stored in the database, you can remove them after submission. Convert Forms does not currently support excluding a specific field from being saved automatically. To achieve this, you can use a simple PHP snippet that clears the field value once the submission is saved. Full details and the code example can be found here: Prevent a Field from Saving in the Database

Frequently Asked Questions

How is the password stored in the database?

Currently, the password value submitted through a Password field is stored as plain text in the database. We are actively exploring ways to improve this by storing it in a hashed and protected format. If you prefer not to store the password, please refer to the section above to prevent it from being stored in the database.

Can I use the Password field for Joomla user registration?

The Password field can be used in custom registration forms built with Convert Forms. In that case, the password will be passed directly to Joomla’s user system, which takes care of storing it securely with hashing.

Can I disable the show / hide password toggle?

The toggle cannot be disabled, but you can hide it with the following CSS override if you prefer not to display it:

.cf-password-toggle {
   display: none;
}

Can I validate the strength of the password?

You can enforce custom password rules (e.g. requiring numbers, uppercase letters, symbols, or a minimum length) using PHP. See the full guide here: Force a Custom Password Policy

Can I prevent the Password field from being included in email notifications?

When using the {all_fields} Smart Tag in email notifications, the Password field is included but its value is masked. If you prefer not to include it at all, you can exclude it from the output by using {all_fields --excludeTypes=password}.