diff --git a/commafeed-server/pom.xml b/commafeed-server/pom.xml
index b718dc0c..41ce044b 100644
--- a/commafeed-server/pom.xml
+++ b/commafeed-server/pom.xml
@@ -404,7 +404,7 @@
 		<dependency>
 			<groupId>org.passay</groupId>
 			<artifactId>passay</artifactId>
-			<version>1.6.6</version>
+			<version>2.0.0</version>
 		</dependency>
 		<dependency>
 			<groupId>com.rometools</groupId>
diff --git a/commafeed-server/src/main/java/com/commafeed/security/password/PasswordConstraintValidator.java b/commafeed-server/src/main/java/com/commafeed/security/password/PasswordConstraintValidator.java
index 34e84e2c..44adfccb 100644
--- a/commafeed-server/src/main/java/com/commafeed/security/password/PasswordConstraintValidator.java
+++ b/commafeed-server/src/main/java/com/commafeed/security/password/PasswordConstraintValidator.java
@@ -6,11 +6,12 @@ import jakarta.validation.ConstraintValidator;
 import jakarta.validation.ConstraintValidatorContext;
 
 import org.apache.commons.lang3.StringUtils;
-import org.passay.LengthRule;
+import org.passay.DefaultPasswordValidator;
 import org.passay.PasswordData;
 import org.passay.PasswordValidator;
-import org.passay.RuleResult;
-import org.passay.WhitespaceRule;
+import org.passay.ValidationResult;
+import org.passay.rule.LengthRule;
+import org.passay.rule.WhitespaceRule;
 
 import lombok.Setter;
 
@@ -31,20 +32,20 @@ public class PasswordConstraintValidator implements ConstraintValidator<ValidPas
 		}
 
 		PasswordValidator validator = buildPasswordValidator();
-		RuleResult result = validator.validate(new PasswordData(value));
+		ValidationResult result = validator.validate(new PasswordData(value));
 
 		if (result.isValid()) {
 			return true;
 		}
 
-		List<String> messages = validator.getMessages(result);
+		List<String> messages = result.getMessages();
 		String message = String.join(System.lineSeparator(), messages);
 		context.buildConstraintViolationWithTemplate(message).addConstraintViolation().disableDefaultConstraintViolation();
 		return false;
 	}
 
 	private PasswordValidator buildPasswordValidator() {
-		return new PasswordValidator(
+		return new DefaultPasswordValidator(
 				// length
 				new LengthRule(minimumPasswordLength, 256),
 				// no whitespace