diff --git a/app/Http/Requests/Bo/AppUser/StoreAppUserRequest.php b/app/Http/Requests/Bo/AppUser/StoreAppUserRequest.php
index 9d87f0f..1d78a17 100644
--- a/app/Http/Requests/Bo/AppUser/StoreAppUserRequest.php
+++ b/app/Http/Requests/Bo/AppUser/StoreAppUserRequest.php
@@ -5,6 +5,7 @@ namespace App\Http\Requests\Bo\AppUser;
 use App\Enums\AppUserRolesEnum;
 use Illuminate\Foundation\Http\FormRequest;
 use Kwaadpepper\Enum\Rules\EnumIsValidRule;
+use Illuminate\Validation\Rules\Password;
 
 class StoreAppUserRequest extends FormRequest
 {
@@ -42,7 +43,14 @@ class StoreAppUserRequest extends FormRequest
             'lastname' => 'required|min:3|max:255',
             'firstname' => 'required|min:3|max:255',
             'email' => 'required|min:3|max:255|email:rfc,dns|unique:app_users,email',
-            'password' => 'required|nullable|required_with:password_confirmation|confirmed|min:8|max:255',
+            'password' => [
+                'required', 'required_with:password_confirmation', 'confirmed', 'max:255',
+                Password::min(8)
+                    ->letters()
+                    ->mixedCase()
+                    ->numbers()
+                    ->symbols()
+            ],
             'authorizedFolders' => 'present|array',
             'role' => [
                 'required',
diff --git a/app/Http/Requests/Bo/AppUser/UpdateAppUserRequest.php b/app/Http/Requests/Bo/AppUser/UpdateAppUserRequest.php
index eca872a..1fb7263 100644
--- a/app/Http/Requests/Bo/AppUser/UpdateAppUserRequest.php
+++ b/app/Http/Requests/Bo/AppUser/UpdateAppUserRequest.php
@@ -2,9 +2,8 @@
 
 namespace App\Http\Requests\Bo\AppUser;
 
-use App\Enums\AppUserRolesEnum;
 use Illuminate\Validation\Rule;
-use Kwaadpepper\Enum\Rules\EnumIsValidRule;
+use Illuminate\Validation\Rules\Password;
 
 class UpdateAppUserRequest extends StoreAppUserRequest
 {
@@ -15,9 +14,7 @@ class UpdateAppUserRequest extends StoreAppUserRequest
      */
     public function rules()
     {
-        return [
-            'lastname' => 'required|min:3|max:255',
-            'firstname' => 'required|min:3|max:255',
+        $rules = [
             'email' => [
                 'required',
                 'min:3',
@@ -25,12 +22,15 @@ class UpdateAppUserRequest extends StoreAppUserRequest
                 'email:rfc,dns',
                 Rule::unique('app_users', 'email')->ignore($this->route('app_user')->id),
             ],
-            'password' => 'sometimes|nullable|required_with:password_confirmation|confirmed|min:8|max:255',
-            'role' => [
-                'required',
-                new EnumIsValidRule(AppUserRolesEnum::class)
+            'password' => [
+                'sometimes', 'nullable', 'required_with:password_confirmation', 'confirmed', 'max:255',
+                Password::min(8)
+                    ->letters()
+                    ->mixedCase()
+                    ->numbers()
+                    ->symbols()
             ],
-            'status' => 'sometimes'
         ];
+        return array_merge(parent::rules(), $rules);
     }
 }
diff --git a/app/Models/AppUser.php b/app/Models/AppUser.php
index 81cb6a1..82dd48d 100644
--- a/app/Models/AppUser.php
+++ b/app/Models/AppUser.php
@@ -38,6 +38,15 @@ class AppUser extends Model
         'order',
     ];
 
+    /**
+     * The attributes that should be hidden for serialization.
+     *
+     * @var array<int, string>
+     */
+    protected $hidden = [
+        'password',
+    ];
+
     /**
      * cast enum
      * @var string[]
@@ -58,17 +67,28 @@ class AppUser extends Model
         static::creating(function (self $model) {
             self::assertFieldIsUnique('email', $model->email);
             self::setOrder($model);
-            $model->password = Hash::make($model->password);
+            static::updatePassword($model);
         });
         static::updating(function (self $model) {
-            if (Hash::needsRehash($model->password)) {
-                $model->password = Hash::make($model->password);
-            }
+            static::updatePassword($model);
         });
     }
 
     // * METHODS
 
+    /**
+     * Update password.
+     *
+     * @param self $model
+     * @return void
+     */
+    private static function updatePassword(self $model): void
+    {
+        if (Hash::needsRehash($model->password)) {
+            $model->password = Hash::make($model->password);
+        }
+    }
+
     /**
      * Asserts using validation that the field is unique.
      *
diff --git a/app/Models/User.php b/app/Models/User.php
index 33fc3a0..7f55e9a 100644
--- a/app/Models/User.php
+++ b/app/Models/User.php
@@ -62,15 +62,26 @@ class User extends Authenticatable
     protected static function booted()
     {
         // * EVENT CLOSURES.
-        static::creating(function (User $user) {
-            if (Hash::needsRehash($user->password)) {
-                $user->password = Hash::make($user->password);
-            }
+        static::creating(function (self $model) {
+            static::updatePassword($model);
         });
-        static::updating(function (User $user) {
-            if (Hash::needsRehash($user->password)) {
-                $user->password = Hash::make($user->password);
-            }
+        static::updating(function (self $model) {
+            static::updatePassword($model);
         });
     }
+
+    // * METHODS
+
+    /**
+     * Update password.
+     *
+     * @param self $model
+     * @return void
+     */
+    private static function updatePassword(self $model): void
+    {
+        if (Hash::needsRehash($model->password)) {
+            $model->password = Hash::make($model->password);
+        }
+    }
 }