# Password in URL validation

**URL:** <https://devforum.zoom.us/t/password-in-url-validation/143407>\
**Category:** Meetings\
**Created:** [May 7, 2026, 4:40pm UTC](https://devforum.zoom.us/t/password-in-url-validation/143407 "2026-05-07T16:40:06Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Brent1](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/brent1/32/67117_2.png) [@Brent1](https://devforum.zoom.us/u/Brent1)\
**Post date:** [May 7, 2026, 4:40pm UTC](https://devforum.zoom.us/t/password-in-url-validation/143407/1 "2026-05-07T16:40:06Z")

</div>

We are trying to use optical character recognition to scan the meeting URL from a calendar entry on a user’s phone screen. It works fairly well, but often the decoding is off by a single character (such as swapping “o” and zero).

Usually the URL includes the “pwd=” field so the user doesn’t need to enter a password.

Is there any way we can validate that password before we attempt to join? Is it always going to be a fixed number of digits? Is there a check digit? Can I validate without attempting to join?

If we could validate the password, we could leave the OCR scanner trying until it decodes a valid password. Then the user would immediately go to the correct meeting without a password prompt.

Thanks for any extra details I can get on the encoded password portion of the URL.

---

<div class="post-metadata">

**Author:** ![Brent1](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/brent1/32/67117_2.png) [@Brent1](https://devforum.zoom.us/u/Brent1)\
**Post date:** [May 8, 2026, 1:12pm UTC](https://devforum.zoom.us/t/password-in-url-validation/143407/2 "2026-05-08T13:12:13Z")

</div>

This is my best guess at validating the URL:

It can contain only:

- capital letters
- lowercase letters
- period
- colon
- front slash
- question mark
- equals sign
- ampersand

`if (!possibleUrl.matches("[A-Za-z0-9.:/?=&]*")) {`  
` Log.d(TAG, "OCR line contains non-URL characters");`  
` continue;`  
`}`

It would be great to know if there are additional valid symbols used, and if those password tokens have an expected length or format. Does anyone have more information on this?