Last updated: August 27, 2026.
Start with HTML validation attributes and add JavaScript only for rules built-in constraints cannot express.
<form id="signup" method="post">
<label>Email <input id="email" name="email" type="email" required></label>
<label>Password <input name="password" type="password" minlength="12" required></label>
<button>Create account</button>
</form>const email = document.querySelector("#email");
email.addEventListener("input", () => {
email.setCustomValidity("");
if (email.validity.valid && email.value.endsWith("@example.invalid")) {
email.setCustomValidity("Use a deliverable email address.");
}
});Client validation can be bypassed. Validate again on the server. See MDN’s validation guide.
