diff --git a/GECO/Account/Password.aspx b/GECO/Account/Password.aspx
index 9ad52e73..ccd5d119 100644
--- a/GECO/Account/Password.aspx
+++ b/GECO/Account/Password.aspx
@@ -40,7 +40,7 @@
                 <td>
                     <asp:TextBox ID="txtOldPassword" runat="server" TextMode="Password" autocomplete="current-password" />
                     <asp:RequiredFieldValidator ID="RequiredFieldValidator1" runat="server" ControlToValidate="txtOldPassword" Display="Dynamic"
-                        ErrorMessage="Old Password is required." Font-Size="Small" ValidationGroup="Password"></asp:RequiredFieldValidator>&nbsp;
+                        ErrorMessage="Old Password is required." Font-Size="Small" ValidationGroup="OldPassword" ForeColor="Red"></asp:RequiredFieldValidator>&nbsp;
                 </td>
             </tr>
             <tr>
@@ -50,11 +50,14 @@
                 <td>
                     <asp:TextBox ID="txtNewPassword" runat="server" TextMode="Password" autocomplete="new-password" aria-describedby="password-constraints" />
                     <asp:RequiredFieldValidator ID="RequiredFieldValidator15" runat="server" ControlToValidate="txtNewPassword" Display="Dynamic"
-                        ErrorMessage="New Password is required." Font-Size="Small" ValidationGroup="Password"></asp:RequiredFieldValidator>
+                        ErrorMessage="New Password is required." Font-Size="Small" ValidationGroup="NewPassword" ForeColor="Red"></asp:RequiredFieldValidator>
                     <asp:RegularExpressionValidator ID="Regex3" runat="server" ControlToValidate="txtNewPassword"
-                        ValidationExpression="^(?=.*[a-z])(?=.*[A-Z])(?=.*\d).{8,}$" ValidationGroup="Password"
-                        ErrorMessage="Password does not meet complexity requirements."
+                        ValidationExpression="^[a-zA-Z0-9]{12,}$" ValidationGroup="NewPassword"
+                        ErrorMessage="Password is too short (minimum of 12 characters)." Display="Dynamic"
                         ForeColor="Red" />
+                    <asp:CustomValidator runat="server" ID="passwordRequirements" ControlToValidate="txtNewPassword"
+                        ClientValidationFunction="validatePassword" ForeColor="red" ValidateEmptyText="true" ValidationGroup="NewPassword"
+                        Display="Dynamic" ErrorMessage="This text will be changed later."> </asp:CustomValidator>
 
                 </td>
             </tr>
@@ -65,17 +68,245 @@
                 <td>
                     <asp:TextBox ID="txtPwdConfirm" runat="server" TextMode="Password" autocomplete="new-password" />
                     <asp:RequiredFieldValidator ID="RequiredFieldValidator16" runat="server" ControlToValidate="txtPwdConfirm" Display="Dynamic"
-                        ErrorMessage="Password Confirmation is required." Font-Size="Small" ValidationGroup="Password"></asp:RequiredFieldValidator>
+                        ErrorMessage="Password Confirmation is required." Font-Size="Small" ValidationGroup="RepeatPassword" ForeColor="Red"></asp:RequiredFieldValidator>
                     <asp:CompareValidator ID="CompareValidator1" runat="server" ControlToCompare="txtNewPassword" ControlToValidate="txtPwdConfirm"
-                        ErrorMessage="Password fields must match." Font-Size="Small" Display="Dynamic" ValidationGroup="Password"></asp:CompareValidator>&nbsp;
+                        ErrorMessage="Password fields must match." Font-Size="Small" Display="Dynamic" ValidationGroup="RepeatPassword" ForeColor="Red"></asp:CompareValidator>&nbsp;
                 </td>
             </tr>
         </table>
 
         <p>
-            <asp:Button ID="btnPwdUpdate" runat="server" Text="Update Password" CausesValidation="true" ValidationGroup="Password" CssClass="button-large" />
+            <asp:Button ID="btnPwdUpdate" runat="server" Text="Update Password" CausesValidation="true"
+                OnClientClick="return client_btnRegister_Click();" CssClass="button-large" />
         </p>
     </asp:Panel>
 
-    <p id="password-constraints">NOTE: New password must contain at least 8 characters with at least 1 uppercase letter, 1 lowercase letter and 1 number.</p>
+    <p id="password-constraints">NOTE: New password must have at least 12 characters, cannot include your login, and is not in a list of passwords commonly used on other websites.</p>
+    
+    <script type="text/javascript">
+        // global variable to track whether the error message is visible
+        var isValidatorValid = true;
+        /**
+         * Client side code to check user's password. Used in CustomValidator ID="passwordRequirements"
+         * @param sender
+         * @param args
+         */
+        function validatePassword(sender, args) {
+            var currEmail = document.getElementById('<%=lblDisplayName.ClientID%>').innerText;
+            var currPassword = document.getElementById('<%=txtNewPassword.ClientID%>').value;
+            if (!checkPasswordValid(currEmail.toLowerCase(), currPassword.toLowerCase())) {
+                // change the content of the error message
+                sender.textContent = "The password cannot contain segments of the URL, app name, or email.";
+                // set the validator isValid to false to make it appear
+                args.IsValid = false;
+            } else {
+                // change the content of the error message (not visible yet)
+                sender.textContent = "The password is in a list of passwords commonly used on other websites.";
+                hibpCheck(currPassword);
+                // set the error message to be visible through the global variable value
+                args.IsValid = isValidatorValid;
+            }
+            return true; // essential
+        }
+
+        /**
+         * Helper function for the validatePassword()
+         * @param email The user email
+         * @param password The user password
+         * @returns True if the password is valid, false otherwise.
+         */
+        function checkPasswordValid(email, password) {
+            // check if these passwords matches the email or website
+            var validPassEmail = FindIntersection(email, password);
+            var validPassWebsite = FindIntersection("geco", password);
+            var validPassDepartment = FindIntersection("gaepd", password);
+
+            // check for falsy values
+            if (!validPassEmail) {
+                validPassEmail = "";
+            }
+            if (!validPassWebsite) {
+                validPassWebsite = "";
+            }
+            if (!validPassDepartment) {
+                validPassDepartment = "";
+            }
+
+            // declare an arbitrary length
+            var maxSequenceLength = 3;
+            return validPassEmail.length <= maxSequenceLength &&
+                validPassWebsite.length <= maxSequenceLength &&
+                validPassDepartment.length <= maxSequenceLength;
+        }
+
+        /**
+         * Find where the sequence starts and its length between 2 strings
+         * @param a First string
+         * @param b Second string
+         * @returns Null if there are no sequence, else return an object with position and length attributes
+         */
+        function FindIntersection(a, b) {
+            var bestResult = null;
+            for (var i = 0; i < a.length - 1; i++) {
+                var result = FindIntersectionFromStart(a.substring(i), b);
+                if (result) {
+                    if (!bestResult) {
+                        bestResult = result;
+                    } else {
+                        if (result.length > bestResult.length) {
+                            bestResult = result;
+                        }
+                    }
+                }
+                if (bestResult && bestResult.length >= a.length - i)
+                    break;
+            }
+            return bestResult;
+        }
+
+        /**
+         * Helper method for FindIntersection()
+         * @param a First string
+         * @param b Second string
+         * @returns Null if there are no sequence, else return an object with position and length attributes
+         */
+        function FindIntersectionFromStart(a, b) {
+            for (var i = a.length; i > 0; i--) {
+                d = a.substring(0, i);
+                j = b.indexOf(d);
+                if (j >= 0) {
+                    return ({ position: j, length: i });
+                }
+            }
+            return null;
+        }
+
+        /**
+         * Code from https://github.com/mehdibo/hibp-js
+         * Helper method to convert a string to sha1 hash
+         * @param string Input String
+         */
+        function sha1(string) {
+            var buffer = new TextEncoder("utf-8").encode(string);
+            return crypto.subtle.digest("SHA-1", buffer).then(function (buffer) {
+                var hexCodes = [];
+                var view = new DataView(buffer);
+                for (var i = 0; i < view.byteLength; i += 4) {
+                    var value = view.getUint32(i);
+                    var stringValue = value.toString(16);
+                    var padding = '00000000';
+                    var paddedValue = (padding + stringValue).slice(-padding.length);
+                    hexCodes.push(paddedValue)
+                }
+                return hexCodes.join("")
+            })
+        }
+
+        /**
+         * Helper method to get the result from the URL
+         * @param url the URL of the website
+         */
+        async function fetchAsync(url) {
+            let response = await fetch(url);
+            return await response.text();
+        }
+
+        /**
+         * Check if the user password matches any pawned passwords
+         * @param pwd The user password
+         */
+        function hibpCheck(pwd) {
+            // convert the string password to sha1 hash
+            sha1(pwd).then(function (sha1Pwd) {
+                // remove the first 5 characters to follow the API
+                const hashSub = sha1Pwd.slice(5).toUpperCase();
+                // fetch the result
+                let url = 'https://api.pwnedpasswords.com/range/' + sha1Pwd.substr(0, 5);
+                //let results = await fetchAsync(url);
+                fetchAsync(url).then(function (results) {
+                    // iterate through the result
+                    let found = false;
+                    for (const result of results.split('\n')) {
+                        if (hashSub.localeCompare(result.split(':')[0]) === 0) {
+                            found = true;
+                            break;
+                        }
+                    }
+                    // a temporary var to store the value before the change
+                    var stateBefore = isValidatorValid;
+                    // display the error
+                    if (found) {
+                        isValidatorValid = false;
+                    } else {
+                        isValidatorValid = true;
+                    }
+                    // re-validate the password custom validator if the state has changed
+                    if (stateBefore != isValidatorValid) {
+                        Reload_Validator();
+                    }
+                });
+            });
+        }
+
+        /**
+         * A helper method to update all of the validators of a group when its TextBox
+         * value is not empty.
+         * This is done because calling Page_ClientValidate on a single group would reset
+         * all of the other validators (does not matter if they are in a group or not).
+         */
+        function Reload_Validator() {
+            var oldPwd = document.getElementById('<%=txtOldPassword.ClientID%>').value;
+            var currPwd = document.getElementById('<%=txtNewPassword.ClientID%>').value;
+            var currConfirmPwd = document.getElementById('<%=txtPwdConfirm.ClientID%>').value;
+            var group = [];
+            // if the TextBox is not empty, then update its group validators
+            if (oldPwd !== "") {
+                group.push("OldPassword");
+            }
+            if (currPwd !== "") {
+                group.push("NewPassword");
+            }
+            if (currConfirmPwd !== "") {
+                group.push("RepeatPassword");
+            }
+            // call the helper method to get all the groups validate again
+            Page_ClientValidateMultiple(group);
+        }
+
+        /**
+         * Page_ClientValidate only shows errors from the last validation group.
+         * This method allows showing for multiple groups.
+         * https://stackoverflow.com/questions/1560812/page-clientvalidate-with-multiple-validationgroups-how-to-show-multiple-summ
+         * @param groups An array that contains the ValidationGroup that we want to re-validate
+         */
+        function Page_ClientValidateMultiple(groups) {
+            var invalidIdxs = [];
+            var result = true;
+
+            // run validation from each group and remember failures
+            for (var g = 0; g < groups.length; g++) {
+                result = Page_ClientValidate(groups[g]) && result;
+                for (var v = 0; v < Page_Validators.length; v++)
+                    if (!Page_Validators[v].isvalid)
+                        invalidIdxs.push(v);
+            }
+
+            // re-show any failures
+            for (var i = 0; i < invalidIdxs.length; i++) {
+                ValidatorValidate(Page_Validators[invalidIdxs[i]]);
+            }
+
+            // return false if any of the groups failed
+            return result;
+        };
+
+        function client_btnRegister_Click() {
+            // call all validators in the page
+            Page_ClientValidate();
+            // this return value determines whether the server-side function is called
+            // true to calling the server-side function, false to prevent it
+            return Page_IsValid;
+        }
+
+    </script>
 </asp:Content>
diff --git a/GECO/Account/Password.aspx.designer.vb b/GECO/Account/Password.aspx.designer.vb
index 06e85d33..91d07db6 100644
--- a/GECO/Account/Password.aspx.designer.vb
+++ b/GECO/Account/Password.aspx.designer.vb
@@ -121,6 +121,15 @@ Partial Public Class Account_Password
     '''</remarks>
     Protected WithEvents Regex3 As Global.System.Web.UI.WebControls.RegularExpressionValidator
 
+    '''<summary>
+    '''passwordRequirements control.
+    '''</summary>
+    '''<remarks>
+    '''Auto-generated field.
+    '''To modify move field declaration from designer file to code-behind file.
+    '''</remarks>
+    Protected WithEvents passwordRequirements As Global.System.Web.UI.WebControls.CustomValidator
+
     '''<summary>
     '''txtPwdConfirm control.
     '''</summary>
diff --git a/GECO/Account/Password.aspx.vb b/GECO/Account/Password.aspx.vb
index e5752ded..8da61456 100644
--- a/GECO/Account/Password.aspx.vb
+++ b/GECO/Account/Password.aspx.vb
@@ -49,4 +49,74 @@ Partial Class Account_Password
         End If
     End Sub
 
+    Protected Sub passwordRequirement_ServerValidate(source As Object, args As ServerValidateEventArgs) Handles passwordRequirements.ServerValidate
+        If checkPasswordValid() Then
+            passwordRequirements.ErrorMessage = "The password cannot contain segments of the URL, app name, or email."
+            args.IsValid = False
+        End If
+    End Sub
+
+    ''' <summary>
+    ''' Helper function for the passwordRequirement_ServerValidate()
+    ''' </summary>
+    ''' <returns>True if the password Is valid, false otherwise.</returns>
+    Private Function checkPasswordValid() As Boolean
+        Dim email As String = lblDisplayName.Text.ToLower
+        Dim password As String = txtNewPassword.Text.ToLower
+
+        ' check if these passwords matches the email Or website
+        Dim validPassEmail As Integer = FindIntersection(email, password)
+        Dim validPassWebsite As Integer = FindIntersection("geco", password)
+        Dim validPassDepartment As Integer = FindIntersection("gaepd", password)
+
+        ' declare an arbitrary length
+        Dim maxSequenceLength As Integer = 3
+        Return validPassEmail <= maxSequenceLength AndAlso
+                validPassWebsite <= maxSequenceLength AndAlso
+                validPassDepartment <= maxSequenceLength
+    End Function
+
+    ''' <summary>
+    ''' Find where the sequence starts And its length between 2 strings
+    ''' </summary>
+    ''' <param name="a">First string</param>
+    ''' <param name="b">Second string</param>
+    ''' <returns>0 if there are no sequence, else return the length</returns>
+    Private Function FindIntersection(a As String, b As String) As Integer
+        Dim bestResult As Integer = 0
+        For i As Integer = 0 To a.Length - 2
+            Dim result As Integer = FindIntersectionFromStart(a.Substring(i), b)
+            If result <> 0 Then
+                If bestResult = 0 Then
+                    bestResult = result
+                Else
+                    If result > bestResult Then
+                        bestResult = result
+                    End If
+                End If
+            End If
+            If bestResult >= a.Length - i Then
+                Exit For
+            End If
+        Next
+        Return bestResult
+    End Function
+
+    ''' <summary>
+    ''' Helper method for FindIntersection()
+    ''' </summary>
+    ''' <param name="a">First string</param>
+    ''' <param name="b">Second string</param>
+    ''' <returns>0 if there are no sequence, else return the length</returns>
+    Private Function FindIntersectionFromStart(a As String, b As String) As Integer
+        For i As Integer = a.Length To 1 Step -1
+            Dim d As String = a.Substring(0, i)
+            Dim j As Integer = b.IndexOf(d)
+            If j >= 0 Then
+                Return i ' return the length
+            End If
+        Next
+        Return 0
+    End Function
+
 End Class
diff --git a/GECO/Register.aspx b/GECO/Register.aspx
index 8a42e742..62a224cd 100644
--- a/GECO/Register.aspx
+++ b/GECO/Register.aspx
@@ -13,36 +13,38 @@
         <asp:Label ID="lblEmail" AssociatedControlID="txtEmail" runat="server" Text="Email:" />
         <br />
         <asp:TextBox ID="txtEmail" runat="server" TextMode="Email" autocomplete="username" />
-        <asp:RequiredFieldValidator ID="RequiredFieldValidator6" runat="server" Display="Dynamic"
-            ControlToValidate="txtEmail" ErrorMessage="Email is required." />
-        <asp:RegularExpressionValidator ID="RegularExpressionValidator1" runat="server" Display="Dynamic"
+        <asp:RequiredFieldValidator ID="RequiredFieldValidator6" runat="server" Display="Dynamic" 
+            ControlToValidate="txtEmail" ErrorMessage="Email is required." ForeColor="red" />
+        <asp:RegularExpressionValidator ID="RegularExpressionValidator1" runat="server" Display="Dynamic" ValidationGroup="confirmEmail"
             ControlToValidate="txtEmail" ErrorMessage="Email address is invalid."
-            ValidationExpression="\w+([-+.']\w+)*@\w+([-.]\w+)*\.\w+([-.]\w+)*" />
-        <asp:CustomValidator ID="cvEmailExists" runat="server" Display="Dynamic"
-            ControlToValidate="txtEmail" ErrorMessage="The email address is already registered." />
+               ValidationExpression="\w+([-+.']\w+)*@\w+([-.]\w+)*\.\w+([-.]\w+)*" ForeColor="red" />
+        <asp:CustomValidator ID="cvEmailExists" runat="server" Display="Dynamic" ValidationGroup="confirmEmail"
+            ControlToValidate="txtEmail" ErrorMessage="The email address is already registered." ForeColor="red" />
     </p>
 
     <p>
         <asp:Label ID="lblPwd" AssociatedControlID="txtPwd" runat="server" Text="Password:" />
         <br />
         <asp:TextBox ID="txtPwd" runat="server" TextMode="Password" autocomplete="new-password" aria-describedby="password-constraints" />
-        <asp:RequiredFieldValidator ID="RequiredFieldValidator15" runat="server" Display="Dynamic"
+        <asp:RequiredFieldValidator ID="RequiredFieldValidator15" runat="server" Display="Dynamic" ForeColor="red" 
             ControlToValidate="txtPwd" ErrorMessage="Password is required." />
-        <asp:RegularExpressionValidator ID="Regex3" runat="server"
-            ControlToValidate="txtPwd" ErrorMessage="Password does not meet complexity requirements."
-            ValidationExpression="^(?=.*[a-z])(?=.*[A-Z])(?=.*\d).{8,}$" />
+        <asp:RegularExpressionValidator ID="Regex3" runat="server" Display="Dynamic"
+            ControlToValidate="txtPwd" ErrorMessage="Password is too short (minimum of 12 characters)." ValidationGroup="confirmPasswordRequirements"
+            ValidationExpression="^[a-zA-Z0-9]{12,}$" ForeColor="red" />
+        <asp:CustomValidator runat="server" ID="passwordRequirements" ControlToValidate="txtPwd" ClientValidationFunction="validatePassword"
+            ForeColor="red" ValidateEmptyText="true" ValidationGroup="confirmPasswordRequirements" Display="Dynamic" ErrorMessage="This text will be changed later."> </asp:CustomValidator>
         <br />
-        <i id="password-constraints">Password must contain at least 8 characters with at least 1 uppercase letter, 1 lowercase letter and 1 number.</i>
+        <em id="password-constraints">Password needs to have at least 12 characters, cannot include your login, and is not in a list of passwords commonly used on other websites.</em>
     </p>
 
     <p>
         <asp:Label ID="lblPwdConfirm" AssociatedControlID="txtPwdConfirm" runat="server" Text="Confirm Password:" />
         <br />
         <asp:TextBox ID="txtPwdConfirm" runat="server" TextMode="Password" autocomplete="new-password" />
-        <asp:RequiredFieldValidator ID="RequiredFieldValidator16" runat="server" Display="Dynamic"
-            ControlToValidate="txtPwdConfirm" ErrorMessage="Password confirmation is required." />
-        <asp:CompareValidator ID="CompareValidator1" runat="server" Display="Dynamic"
-            ControlToCompare="txtPwd" ControlToValidate="txtPwdConfirm" ErrorMessage="Passwords do not match" />
+        <asp:RequiredFieldValidator ID="RequiredFieldValidator16" runat="server" Display="Dynamic" 
+            ControlToValidate="txtPwdConfirm" ErrorMessage="Password confirmation is required." ForeColor="red" />
+        <asp:CompareValidator ID="CompareValidator1" runat="server" Display="Dynamic" ValidationGroup="confirmPassword"
+            ControlToCompare="txtPwd" ControlToValidate="txtPwdConfirm" ErrorMessage="Passwords do not match" ForeColor="red" />
     </p>
 
     <asp:UpdatePanel ID="CaptchaUpdatePanel" runat="server">
@@ -51,10 +53,10 @@
                 <asp:Label ID="lblCaptcha" AssociatedControlID="txtCaptcha" runat="server" Text="Enter code as displayed in the image:" />
                 <br />
                 <asp:TextBox ID="txtCaptcha" runat="server" />
-                <asp:RequiredFieldValidator ID="RequiredFieldValidator19" runat="server" Display="Dynamic"
-                    ControlToValidate="txtCaptcha" ErrorMessage="Enter code as displayed in the image." />
-                <asp:CustomValidator ID="cvCaptcha" runat="server" Display="Dynamic"
-                    ControlToValidate="txtCaptcha" ErrorMessage="Code was incorrect or expired." />
+                <asp:RequiredFieldValidator ID="RequiredFieldValidator19" runat="server" Display="Dynamic" 
+                    ControlToValidate="txtCaptcha" ErrorMessage="Enter code as displayed in the image." ForeColor="red" />
+                <asp:CustomValidator ID="cvCaptcha" runat="server" Display="Dynamic" ValidationGroup="confirmCaptcha"
+                    ControlToValidate="txtCaptcha" ErrorMessage="Code was incorrect or expired." ForeColor="red" />
                 <captcha:CaptchaControl ID="captchaControl" runat="server" CaptchaBackgroundNoise="high"
                     CaptchaLength="5" CaptchaHeight="50" CaptchaWidth="180" CaptchaLineNoise="None"
                     CaptchaMinTimeout="1" CaptchaMaxTimeout="240"
@@ -65,7 +67,8 @@
     </asp:UpdatePanel>
 
     <p>
-        <asp:Button ID="btnRegister" runat="server" Text="Register" CssClass="button-large" />
+        <asp:Button ID="btnRegister" runat="server" Text="Register" CssClass="button-large" CausesValidation="true"
+            OnClientClick="return client_btnRegister_Click();" OnClick="btnRegister_Click"/>
     </p>
 
     <p class="message-highlight">
@@ -85,4 +88,234 @@
             </div>
         </ProgressTemplate>
     </asp:UpdateProgress>
+    <script type="text/javascript">
+        // global variable to track whether the error message is visible
+        var isValidatorValid = true;
+        /**
+         * Client side code to check user's password. Used in CustomValidator ID="passwordRequirements"
+         * @param sender
+         * @param args
+         */
+        function validatePassword(sender, args) {
+            var currEmail = document.getElementById('<%=txtEmail.ClientID%>').value;
+            var currPassword = document.getElementById('<%=txtPwd.ClientID%>').value;
+            if (!checkPasswordValid(currEmail.toLowerCase(), currPassword.toLowerCase())) {
+                // change the content of the error message
+                sender.textContent = "The password cannot contain segments of the URL, app name, or email.";
+                // set the validator isValid to false to make it appear
+                args.IsValid = false;
+            } else {
+                // change the content of the error message (not visible yet)
+                sender.textContent = "The password is in a list of passwords commonly used on other websites.";
+                hibpCheck(currPassword);
+                // set the error message to be visible through the global variable value
+                args.IsValid = isValidatorValid;
+            }
+            return true; // essential
+        }
+
+        /**
+         * Helper function for the validatePassword()
+         * @param email The user email
+         * @param password The user password
+         * @returns True if the password is valid, false otherwise.
+         */
+        function checkPasswordValid(email, password) {
+            // check if these passwords matches the email or website
+            var validPassEmail = FindIntersection(email, password);
+            var validPassWebsite = FindIntersection("geco", password);
+            var validPassDepartment = FindIntersection("gaepd", password);
+
+            // check for falsy values
+            if (!validPassEmail) {
+                validPassEmail = "";
+            }
+            if (!validPassWebsite) {
+                validPassWebsite = "";
+            }
+            if (!validPassDepartment) {
+                validPassDepartment = "";
+            }
+
+            // declare an arbitrary length
+            var maxSequenceLength = 3;
+            return validPassEmail.length <= maxSequenceLength &&
+                validPassWebsite.length <= maxSequenceLength &&
+                validPassDepartment.length <= maxSequenceLength;
+        }
+
+        /**
+         * Find where the sequence starts and its length between 2 strings
+         * @param a First string
+         * @param b Second string
+         * @returns Null if there are no sequence, else return an object with position and length attributes
+         */
+        function FindIntersection(a, b) {
+            var bestResult = null;
+            for (var i = 0; i < a.length - 1; i++) {
+                var result = FindIntersectionFromStart(a.substring(i), b);
+                if (result) {
+                    if (!bestResult) {
+                        bestResult = result;
+                    } else {
+                        if (result.length > bestResult.length) {
+                            bestResult = result;
+                        }
+                    }
+                }
+                if (bestResult && bestResult.length >= a.length - i)
+                    break;
+            }
+            return bestResult;
+        }
+
+        /**
+         * Helper method for FindIntersection()
+         * @param a First string
+         * @param b Second string
+         * @returns Null if there are no sequence, else return an object with position and length attributes
+         */
+        function FindIntersectionFromStart(a, b) {
+            for (var i = a.length; i > 0; i--) {
+                d = a.substring(0, i);
+                j = b.indexOf(d);
+                if (j >= 0) {
+                    return ({ position: j, length: i });
+                }
+            }
+            return null;
+        }
+
+        /**
+         * Code from https://github.com/mehdibo/hibp-js
+         * Helper method to convert a string to sha1 hash
+         * @param string Input String
+         */
+        function sha1(string) {
+            var buffer = new TextEncoder("utf-8").encode(string);
+            return crypto.subtle.digest("SHA-1", buffer).then(function (buffer) {
+                var hexCodes = [];
+                var view = new DataView(buffer);
+                for (var i = 0; i < view.byteLength; i += 4) {
+                    var value = view.getUint32(i);
+                    var stringValue = value.toString(16);
+                    var padding = '00000000';
+                    var paddedValue = (padding + stringValue).slice(-padding.length);
+                    hexCodes.push(paddedValue)
+                }
+                return hexCodes.join("")
+            })
+        }
+
+        /**
+         * Helper method to get the result from the URL
+         * @param url the URL of the website
+         */
+        async function fetchAsync(url) {
+            let response = await fetch(url);
+            return await response.text();
+        }
+
+        /**
+         * Check if the user password matches any pawned passwords
+         * @param pwd The user password
+         */
+        function hibpCheck(pwd) {
+            // convert the string password to sha1 hash
+            sha1(pwd).then(function (sha1Pwd) {
+                // remove the first 5 characters to follow the API
+                const hashSub = sha1Pwd.slice(5).toUpperCase();
+                // fetch the result
+                let url = 'https://api.pwnedpasswords.com/range/' + sha1Pwd.substr(0, 5);
+                //let results = await fetchAsync(url);
+                fetchAsync(url).then(function (results) {
+                    // iterate through the result
+                    let found = false;
+                    for (const result of results.split('\n')) {
+                        if (hashSub.localeCompare(result.split(':')[0]) === 0) {
+                            found = true;
+                            break;
+                        }
+                    }
+                    // a temporary var to store the value before the change
+                    var stateBefore = isValidatorValid;
+                    // display the error
+                    if (found) {
+                        isValidatorValid = false;
+                    } else {
+                        isValidatorValid = true;
+                    }
+                    // re-validate the password custom validator if the state has changed
+                    if (stateBefore != isValidatorValid) {
+                        Reload_Validator();
+                    }
+                });
+            });
+        }
+
+        /**
+         * A helper method to update all of the validators of a group when its TextBox
+         * value is not empty.
+         * This is done because calling Page_ClientValidate on a single group would reset
+         * all of the other validators (does not matter if they are in a group or not).
+         */
+        function Reload_Validator() {
+            var currEmail = document.getElementById('<%=txtEmail.ClientID%>').value;
+            var currPwd = document.getElementById('<%=txtPwd.ClientID%>').value;
+            var currConfirmPwd = document.getElementById('<%=txtPwdConfirm.ClientID%>').value;
+            var currCaptcha = document.getElementById('<%=txtCaptcha.ClientID%>').value;
+            var group = [];
+            // if the TextBox is not empty, then update its group validators
+            if (currEmail !== "") {
+                group.push("confirmEmail");
+            }
+            if (currPwd !== "") {
+                group.push("confirmPasswordRequirements");
+            }
+            if (currConfirmPwd !== "") {
+                group.push("confirmPassword");
+            }
+            if (currCaptcha !== "") {
+                group.push("confirmCaptcha");
+            }
+            // call the helper method to get all the groups validate again
+            Page_ClientValidateMultiple(group);
+        }
+
+        /**
+         * Page_ClientValidate only shows errors from the last validation group.
+         * This method allows showing for multiple groups.
+         * https://stackoverflow.com/questions/1560812/page-clientvalidate-with-multiple-validationgroups-how-to-show-multiple-summ
+         * @param groups An array that contains the ValidationGroup that we want to re-validate
+         */
+        function Page_ClientValidateMultiple(groups) {
+            var invalidIdxs = [];
+            var result = true;
+
+            // run validation from each group and remember failures
+            for (var g = 0; g < groups.length; g++) {
+                result = Page_ClientValidate(groups[g]) && result;
+                for (var v = 0; v < Page_Validators.length; v++)
+                    if (!Page_Validators[v].isvalid)
+                        invalidIdxs.push(v);
+            }
+
+            // re-show any failures
+            for (var i = 0; i < invalidIdxs.length; i++) {
+                ValidatorValidate(Page_Validators[invalidIdxs[i]]);
+            }
+
+            // return false if any of the groups failed
+            return result;
+        };
+
+        function client_btnRegister_Click() {
+            // call all validators in the page
+            Page_ClientValidate();
+            // this return value determines whether the server-side function is called
+            // true to calling the server-side function, false to prevent it
+            return Page_IsValid;
+        }
+
+    </script>
 </asp:Content>
diff --git a/GECO/Register.aspx.designer.vb b/GECO/Register.aspx.designer.vb
index 84e25fa2..18e6237e 100644
--- a/GECO/Register.aspx.designer.vb
+++ b/GECO/Register.aspx.designer.vb
@@ -12,7 +12,7 @@ Option Explicit On
 
 
 Partial Public Class Register
-    
+
     '''<summary>
     '''lblEmail control.
     '''</summary>
@@ -21,7 +21,7 @@ Partial Public Class Register
     '''To modify move field declaration from designer file to code-behind file.
     '''</remarks>
     Protected WithEvents lblEmail As Global.System.Web.UI.WebControls.Label
-    
+
     '''<summary>
     '''txtEmail control.
     '''</summary>
@@ -30,7 +30,7 @@ Partial Public Class Register
     '''To modify move field declaration from designer file to code-behind file.
     '''</remarks>
     Protected WithEvents txtEmail As Global.System.Web.UI.WebControls.TextBox
-    
+
     '''<summary>
     '''RequiredFieldValidator6 control.
     '''</summary>
@@ -39,7 +39,7 @@ Partial Public Class Register
     '''To modify move field declaration from designer file to code-behind file.
     '''</remarks>
     Protected WithEvents RequiredFieldValidator6 As Global.System.Web.UI.WebControls.RequiredFieldValidator
-    
+
     '''<summary>
     '''RegularExpressionValidator1 control.
     '''</summary>
@@ -48,7 +48,7 @@ Partial Public Class Register
     '''To modify move field declaration from designer file to code-behind file.
     '''</remarks>
     Protected WithEvents RegularExpressionValidator1 As Global.System.Web.UI.WebControls.RegularExpressionValidator
-    
+
     '''<summary>
     '''cvEmailExists control.
     '''</summary>
@@ -57,7 +57,7 @@ Partial Public Class Register
     '''To modify move field declaration from designer file to code-behind file.
     '''</remarks>
     Protected WithEvents cvEmailExists As Global.System.Web.UI.WebControls.CustomValidator
-    
+
     '''<summary>
     '''lblPwd control.
     '''</summary>
@@ -66,7 +66,7 @@ Partial Public Class Register
     '''To modify move field declaration from designer file to code-behind file.
     '''</remarks>
     Protected WithEvents lblPwd As Global.System.Web.UI.WebControls.Label
-    
+
     '''<summary>
     '''txtPwd control.
     '''</summary>
@@ -75,7 +75,7 @@ Partial Public Class Register
     '''To modify move field declaration from designer file to code-behind file.
     '''</remarks>
     Protected WithEvents txtPwd As Global.System.Web.UI.WebControls.TextBox
-    
+
     '''<summary>
     '''RequiredFieldValidator15 control.
     '''</summary>
@@ -84,7 +84,7 @@ Partial Public Class Register
     '''To modify move field declaration from designer file to code-behind file.
     '''</remarks>
     Protected WithEvents RequiredFieldValidator15 As Global.System.Web.UI.WebControls.RequiredFieldValidator
-    
+
     '''<summary>
     '''Regex3 control.
     '''</summary>
@@ -93,7 +93,16 @@ Partial Public Class Register
     '''To modify move field declaration from designer file to code-behind file.
     '''</remarks>
     Protected WithEvents Regex3 As Global.System.Web.UI.WebControls.RegularExpressionValidator
-    
+
+    '''<summary>
+    '''passwordRequirements control.
+    '''</summary>
+    '''<remarks>
+    '''Auto-generated field.
+    '''To modify move field declaration from designer file to code-behind file.
+    '''</remarks>
+    Protected WithEvents passwordRequirements As Global.System.Web.UI.WebControls.CustomValidator
+
     '''<summary>
     '''lblPwdConfirm control.
     '''</summary>
@@ -102,7 +111,7 @@ Partial Public Class Register
     '''To modify move field declaration from designer file to code-behind file.
     '''</remarks>
     Protected WithEvents lblPwdConfirm As Global.System.Web.UI.WebControls.Label
-    
+
     '''<summary>
     '''txtPwdConfirm control.
     '''</summary>
@@ -111,7 +120,7 @@ Partial Public Class Register
     '''To modify move field declaration from designer file to code-behind file.
     '''</remarks>
     Protected WithEvents txtPwdConfirm As Global.System.Web.UI.WebControls.TextBox
-    
+
     '''<summary>
     '''RequiredFieldValidator16 control.
     '''</summary>
@@ -120,7 +129,7 @@ Partial Public Class Register
     '''To modify move field declaration from designer file to code-behind file.
     '''</remarks>
     Protected WithEvents RequiredFieldValidator16 As Global.System.Web.UI.WebControls.RequiredFieldValidator
-    
+
     '''<summary>
     '''CompareValidator1 control.
     '''</summary>
@@ -129,7 +138,7 @@ Partial Public Class Register
     '''To modify move field declaration from designer file to code-behind file.
     '''</remarks>
     Protected WithEvents CompareValidator1 As Global.System.Web.UI.WebControls.CompareValidator
-    
+
     '''<summary>
     '''CaptchaUpdatePanel control.
     '''</summary>
@@ -138,7 +147,7 @@ Partial Public Class Register
     '''To modify move field declaration from designer file to code-behind file.
     '''</remarks>
     Protected WithEvents CaptchaUpdatePanel As Global.System.Web.UI.UpdatePanel
-    
+
     '''<summary>
     '''lblCaptcha control.
     '''</summary>
@@ -147,7 +156,7 @@ Partial Public Class Register
     '''To modify move field declaration from designer file to code-behind file.
     '''</remarks>
     Protected WithEvents lblCaptcha As Global.System.Web.UI.WebControls.Label
-    
+
     '''<summary>
     '''txtCaptcha control.
     '''</summary>
@@ -156,7 +165,7 @@ Partial Public Class Register
     '''To modify move field declaration from designer file to code-behind file.
     '''</remarks>
     Protected WithEvents txtCaptcha As Global.System.Web.UI.WebControls.TextBox
-    
+
     '''<summary>
     '''RequiredFieldValidator19 control.
     '''</summary>
@@ -165,7 +174,7 @@ Partial Public Class Register
     '''To modify move field declaration from designer file to code-behind file.
     '''</remarks>
     Protected WithEvents RequiredFieldValidator19 As Global.System.Web.UI.WebControls.RequiredFieldValidator
-    
+
     '''<summary>
     '''cvCaptcha control.
     '''</summary>
@@ -174,7 +183,7 @@ Partial Public Class Register
     '''To modify move field declaration from designer file to code-behind file.
     '''</remarks>
     Protected WithEvents cvCaptcha As Global.System.Web.UI.WebControls.CustomValidator
-    
+
     '''<summary>
     '''captchaControl control.
     '''</summary>
@@ -183,7 +192,7 @@ Partial Public Class Register
     '''To modify move field declaration from designer file to code-behind file.
     '''</remarks>
     Protected WithEvents captchaControl As Global.MSCaptcha.CaptchaControl
-    
+
     '''<summary>
     '''lbtnRefreshCaptcha control.
     '''</summary>
@@ -192,7 +201,7 @@ Partial Public Class Register
     '''To modify move field declaration from designer file to code-behind file.
     '''</remarks>
     Protected WithEvents lbtnRefreshCaptcha As Global.System.Web.UI.WebControls.LinkButton
-    
+
     '''<summary>
     '''btnRegister control.
     '''</summary>
@@ -201,7 +210,7 @@ Partial Public Class Register
     '''To modify move field declaration from designer file to code-behind file.
     '''</remarks>
     Protected WithEvents btnRegister As Global.System.Web.UI.WebControls.Button
-    
+
     '''<summary>
     '''CaptchaUpdateProgress control.
     '''</summary>
@@ -210,7 +219,7 @@ Partial Public Class Register
     '''To modify move field declaration from designer file to code-behind file.
     '''</remarks>
     Protected WithEvents CaptchaUpdateProgress As Global.System.Web.UI.UpdateProgress
-    
+
     '''<summary>
     '''Master property.
     '''</summary>
@@ -219,7 +228,7 @@ Partial Public Class Register
     '''</remarks>
     Public Shadows ReadOnly Property Master() As GECO.MainLayout
         Get
-            Return CType(MyBase.Master,GECO.MainLayout)
+            Return CType(MyBase.Master, GECO.MainLayout)
         End Get
     End Property
 End Class
diff --git a/GECO/Register.aspx.vb b/GECO/Register.aspx.vb
index 19166a28..ca243ffc 100644
--- a/GECO/Register.aspx.vb
+++ b/GECO/Register.aspx.vb
@@ -16,6 +16,8 @@ Partial Class Register
     End Sub
 
     Protected Sub btnRegister_Click(sender As Object, e As EventArgs) Handles btnRegister.Click
+        Page.Validate()
+
         If IsValid Then
             Dim email As String = txtEmail.Text.Trim()
 
@@ -46,14 +48,84 @@ Partial Class Register
         txtCaptcha.Text = ""
     End Sub
 
-    Private Sub cvEmailExists_ServerValidate(source As Object, args As ServerValidateEventArgs) Handles cvEmailExists.ServerValidate
+    Protected Sub cvEmailExists_ServerValidate(source As Object, args As ServerValidateEventArgs) Handles cvEmailExists.ServerValidate
         args.IsValid = Not GecoUserExists(args.Value)
     End Sub
 
-    Private Sub cvCaptcha_ServerValidate(source As Object, args As ServerValidateEventArgs) Handles cvCaptcha.ServerValidate
+    Protected Sub cvCaptcha_ServerValidate(source As Object, args As ServerValidateEventArgs) Handles cvCaptcha.ServerValidate
         captchaControl.ValidateCaptcha(txtCaptcha.Text)
         txtCaptcha.Text = ""
         args.IsValid = captchaControl.UserValidated
     End Sub
 
+    Protected Sub passwordRequirement_ServerValidate(source As Object, args As ServerValidateEventArgs) Handles passwordRequirements.ServerValidate
+        If checkPasswordValid() Then
+            passwordRequirements.ErrorMessage = "The password cannot contain segments of the URL, app name, or email."
+            args.IsValid = False
+        End If
+    End Sub
+
+    ''' <summary>
+    ''' Helper function for the passwordRequirement_ServerValidate()
+    ''' </summary>
+    ''' <returns>True if the password Is valid, false otherwise.</returns>
+    Private Function checkPasswordValid() As Boolean
+        Dim email As String = txtEmail.Text.ToLower
+        Dim password As String = txtPwd.Text.ToLower
+
+        ' check if these passwords matches the email Or website
+        Dim validPassEmail As Integer = FindIntersection(email, password)
+        Dim validPassWebsite As Integer = FindIntersection("geco", password)
+        Dim validPassDepartment As Integer = FindIntersection("gaepd", password)
+
+        ' declare an arbitrary length
+        Dim maxSequenceLength As Integer = 3
+        Return validPassEmail <= maxSequenceLength AndAlso
+                validPassWebsite <= maxSequenceLength AndAlso
+                validPassDepartment <= maxSequenceLength
+    End Function
+
+    ''' <summary>
+    ''' Find where the sequence starts And its length between 2 strings
+    ''' </summary>
+    ''' <param name="a">First string</param>
+    ''' <param name="b">Second string</param>
+    ''' <returns>0 if there are no sequence, else return the length</returns>
+    Private Function FindIntersection(a As String, b As String) As Integer
+        Dim bestResult As Integer = 0
+        For i As Integer = 0 To a.Length - 2
+            Dim result As Integer = FindIntersectionFromStart(a.Substring(i), b)
+            If result <> 0 Then
+                If bestResult = 0 Then
+                    bestResult = result
+                Else
+                    If result > bestResult Then
+                        bestResult = result
+                    End If
+                End If
+            End If
+            If bestResult >= a.Length - i Then
+                Exit For
+            End If
+        Next
+        Return bestResult
+    End Function
+
+    ''' <summary>
+    ''' Helper method for FindIntersection()
+    ''' </summary>
+    ''' <param name="a">First string</param>
+    ''' <param name="b">Second string</param>
+    ''' <returns>0 if there are no sequence, else return the length</returns>
+    Private Function FindIntersectionFromStart(a As String, b As String) As Integer
+        For i As Integer = a.Length To 1 Step -1
+            Dim d As String = a.Substring(0, i)
+            Dim j As Integer = b.IndexOf(d)
+            If j >= 0 Then
+                Return i ' return the length
+            End If
+        Next
+        Return 0
+    End Function
+
 End Class
diff --git a/GECO/Web.configBuilder.xml b/GECO/Web.configBuilder.xml
index adf6c0d6..cf35c757 100644
--- a/GECO/Web.configBuilder.xml
+++ b/GECO/Web.configBuilder.xml
@@ -137,7 +137,7 @@
                 <x-XSS-Protection policy="FilterEnabled" blockMode="true"/>
                 <x-Content-Type-Options enabled="true"/>
                 <referrer-Policy enabled="true" policy="strict-origin-when-cross-origin"/>
-                <content-Security-Policy enabled="true" >
+                <content-Security-Policy enabled="false" >
                     <default-src none="true"/>
                     <script-src self="true" unsafeInline="true" unsafeEval="true">
                         <add source="https://cdn.raygun.io/raygun4js/raygun.min.js"/>