diff --git a/app/Dockerfile b/app/Dockerfile
index eafe05a..df72388 100644
--- a/app/Dockerfile
+++ b/app/Dockerfile
@@ -5,6 +5,7 @@ COPY package.json yarn.lock ./
 COPY app/package.json ./app/package.json
 COPY packages/file-graph/package.json ./packages/file-graph/package.json
 COPY packages/utils/package.json ./packages/utils/package.json
+COPY packages/constants/package.json ./packages/constants/package.json
 RUN yarn install --frozen-lockfile
 
 # Dev stage
@@ -16,6 +17,7 @@ CMD [ "yarn", "dev:docker", "--host", "0.0.0.0" ]
 FROM base as build
 COPY packages/file-graph ./packages/file-graph
 COPY packages/utils ./packages/utils
+COPY packages/constants ./packages/constants
 COPY app ./app
 RUN yarn build
 
diff --git a/app/package.json b/app/package.json
index 9746862..7152e58 100644
--- a/app/package.json
+++ b/app/package.json
@@ -11,15 +11,17 @@
     "preview": "vite preview"
   },
   "dependencies": {
-    "@linux-odyssey/file-graph": "*",
-    "@linux-odyssey/utils": "*",
     "@fortawesome/fontawesome-svg-core": "^6.4.0",
     "@fortawesome/free-brands-svg-icons": "^6.4.0",
     "@fortawesome/free-regular-svg-icons": "^6.4.0",
     "@fortawesome/free-solid-svg-icons": "^6.4.0",
     "@fortawesome/vue-fontawesome": "^3.0.3",
+    "@linux-odyssey/file-graph": "*",
+    "@linux-odyssey/utils": "*",
+    "@linux-odyssey/constants": "*",
     "axios": "^1.4.0",
     "socket.io-client": "^4.7.1",
+    "validator": "^13.11.0",
     "vue": "^3.3.4",
     "vue-router": "^4.2.4",
     "xterm": "^5.2.1",
diff --git a/app/src/components/AuthForm.vue b/app/src/components/AuthForm.vue
index d8c2088..7438907 100644
--- a/app/src/components/AuthForm.vue
+++ b/app/src/components/AuthForm.vue
@@ -128,6 +128,7 @@ const handleChange = () => {
           class="my-4 bg-background-primary text-text-primary bg- rounded-md block w-full px-3 h-10 shadow-sm focus:outline-none placeholder:text-text-line focus:ring-2 focus:ring-text-primary ring-1 ring-background-secondary"
           :placeholder="type === 'login' ? 'Email / Username' : 'Username'"
           v-model="username"
+          required
           @input="handleChange()"
           autocomplete="username"
         />
@@ -147,6 +148,7 @@ const handleChange = () => {
           class="my-4 bg-background-primary text-text-primary bg- rounded-md block w-full px-3 h-10 shadow-sm focus:outline-none placeholder:text-text-line focus:ring-2 focus:ring-text-primary ring-1 ring-background-secondary"
           placeholder="Email"
           v-model="email"
+          required
           @input="handleChange()"
           autocomplete="email"
         />
@@ -158,6 +160,7 @@ const handleChange = () => {
           class="my-4 bg-background-primary text-text-primary bg- rounded-md block w-full px-3 h-10 shadow-sm focus:outline-none placeholder:text-text-line focus:ring-2 focus:ring-text-primary ring-1 ring-background-secondary"
           placeholder="Password"
           v-model="password"
+          required
           @input="handleChange()"
         />
       </div>
diff --git a/app/src/views/RegisterPage.vue b/app/src/views/RegisterPage.vue
index f12b16d..f8cb967 100644
--- a/app/src/views/RegisterPage.vue
+++ b/app/src/views/RegisterPage.vue
@@ -1,5 +1,7 @@
 <script setup>
-import { isValidEmail, isValidUsername } from '@linux-odyssey/utils'
+import validator from 'validator'
+import { isValidUsername } from '@linux-odyssey/utils'
+import { passwordPolicy } from '@linux-odyssey/constants'
 import AuthForm from '../components/AuthForm.vue'
 import Background from '../components/DynamicBackground.vue'
 
@@ -27,29 +29,35 @@ function handleRegister({ username, email, password, success, error }) {
     })
 }
 
-async function check({ username, email, error }) {
+async function check({ username, email, password, error }) {
   if (username && !isValidUsername(username)) {
     error('Invalid username.')
     return
   }
-  if (email && !isValidEmail(email)) {
+  if (email && !validator.isEmail(email)) {
     error('Invalid email.')
     return
   }
-  if (!username && !email) {
+  if (password && !validator.isStrongPassword(password, passwordPolicy)) {
+    error(
+      'Your password must be 8+ characters with at least one number, one upper and one lower case letter.'
+    )
+    return
+  }
+  if (!(username && email && password)) {
     return
   }
   try {
     const res = await api.get('/auth/check-username', {
       params: { username },
     })
-    const { type, available } = res.data
+    const { available } = res.data
     if (!available) {
-      error(`${type} already exists.`)
+      error(`Username already exists.`)
     }
   } catch (err) {
     if (err.response?.status === 400) {
-      error('Invalid username or email.')
+      error('Invalid username.')
       return
     }
     console.error(err)
diff --git a/packages/constants/index.js b/packages/constants/index.js
new file mode 100644
index 0000000..0ff060b
--- /dev/null
+++ b/packages/constants/index.js
@@ -0,0 +1,11 @@
+export const passwordPolicy = {
+  minLength: 8,
+  minNumbers: 1,
+  minLowercase: 1,
+  minUppercase: 1,
+  minSymbols: 0,
+}
+
+export default {
+  passwordPolicy,
+}
diff --git a/packages/constants/package.json b/packages/constants/package.json
new file mode 100644
index 0000000..3e34c03
--- /dev/null
+++ b/packages/constants/package.json
@@ -0,0 +1,9 @@
+{
+  "name": "@linux-odyssey/constants",
+  "type": "module",
+  "version": "1.0.0",
+  "private": true,
+  "main": "index.js",
+  "exports": "./index.js",
+  "license": "GPL"
+}
diff --git a/server/Dockerfile b/server/Dockerfile
index a07526f..62f6159 100644
--- a/server/Dockerfile
+++ b/server/Dockerfile
@@ -6,6 +6,7 @@ COPY server/package.json ./server/package.json
 COPY packages/file-graph/package.json ./packages/file-graph/package.json
 COPY packages/utils/package.json ./packages/utils/package.json
 COPY packages/models/package.json ./packages/models/package.json
+COPY packages/constants/package.json ./packages/constants/package.json
 RUN yarn install --frozen-lockfile --production
 # Install docker cli
 COPY --from=docker:dind /usr/local/bin/docker /usr/local/bin/
@@ -20,6 +21,7 @@ FROM build as prod
 COPY packages/file-graph ./packages/file-graph
 COPY packages/utils ./packages/utils
 COPY packages/models ./packages/models
+COPY packages/constants ./packages/constants
 COPY ./server ./server
 COPY quests ./quests
 
diff --git a/server/package.json b/server/package.json
index d744625..5b58070 100644
--- a/server/package.json
+++ b/server/package.json
@@ -14,6 +14,7 @@
     "@linux-odyssey/file-graph": "*",
     "@linux-odyssey/models": "*",
     "@linux-odyssey/utils": "*",
+    "@linux-odyssey/constants": "*",
     "bcrypt": "^5.1.1",
     "commander": "^11.0.0",
     "connect-mongo": "^5.0.0",
diff --git a/server/src/api/validators/authValidator.js b/server/src/api/validators/authValidator.js
index 9ed7172..dbb5b11 100644
--- a/server/src/api/validators/authValidator.js
+++ b/server/src/api/validators/authValidator.js
@@ -1,10 +1,11 @@
-import { query } from 'express-validator'
+import { check } from 'express-validator'
 
 import { isValidUsername } from '@linux-odyssey/utils'
 import { User } from '@linux-odyssey/models'
+import { passwordPolicy } from '@linux-odyssey/constants'
 
 export const checkUsername = () =>
-  query('username')
+  check('username')
     .notEmpty()
     .isString()
     .custom((username) => {
@@ -23,7 +24,7 @@ export const checkNewUsername = () =>
     return true
   })
 
-export const checkEmail = () => query('email').notEmpty().isEmail().trim()
+export const checkEmail = () => check('email').notEmpty().isEmail().trim()
 
 export const checkNewEmail = () =>
   checkEmail().custom(async (email) => {
@@ -34,10 +35,4 @@ export const checkNewEmail = () =>
   })
 
 export const checkPassword = () =>
-  query('password').notEmpty().isStrongPassword({
-    minLength: 8,
-    minNumbers: 1,
-    minLowercase: 1,
-    minUppercase: 1,
-    minSymbols: 0,
-  })
+  check('password').notEmpty().isStrongPassword(passwordPolicy)
diff --git a/server/src/config.js b/server/src/config.js
index d51a71e..d939e70 100644
--- a/server/src/config.js
+++ b/server/src/config.js
@@ -1,4 +1,4 @@
-import { get, genSecret } from './utils/env.js'
+import { get } from './utils/env.js'
 
 const config = {
   host: get('HOST', 'localhost'),
@@ -23,10 +23,11 @@ const config = {
 config.baseUrl = get('BASE_URL', `http://${config.host}:${config.port}`)
 
 if (!config.secret) {
-  config.secret = genSecret()
   console.warn(
-    'No SECRET_KEY found in .env! A temporary secret key has been generated. To set up a persistent key, please run the setup script.'
+    'No SECRET_KEY found in .env! To set up a persistent key, please run the setup script:'
   )
+  console.warn('yarn setup')
+  process.exit(1)
 }
 
 export default config
diff --git a/yarn.lock b/yarn.lock
index c5994d7..fb0b8f7 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -6092,7 +6092,7 @@ v8-to-istanbul@^9.0.1:
     "@types/istanbul-lib-coverage" "^2.0.1"
     convert-source-map "^1.6.0"
 
-validator@^13.9.0:
+validator@^13.11.0, validator@^13.9.0:
   version "13.11.0"
   resolved "https://registry.yarnpkg.com/validator/-/validator-13.11.0.tgz#23ab3fd59290c61248364eabf4067f04955fbb1b"
   integrity sha512-Ii+sehpSfZy+At5nPdnyMhx78fEoPDkR2XW/zimHEL3MyGJQOCQ7WeP20jPYRz7ZCpcKLB21NxuXHF3bxjStBQ==