diff --git a/src/ddns_service/cli.py b/src/ddns_service/cli.py
index 04d1016..17d07fe 100644
--- a/src/ddns_service/cli.py
+++ b/src/ddns_service/cli.py
@@ -17,6 +17,15 @@ from .models import (
 )
 
 
+def validate_password(password, confirm):
+    """Validate password and confirmation match with min length."""
+    if password != confirm:
+        return "Error: Passwords do not match."
+    if len(password) < 8:
+        return "Error: Password must be at least 8 characters."
+    return None
+
+
 def cmd_user_list(args, app):
     """List all users."""
     users = User.select().order_by(User.username)
@@ -53,12 +62,9 @@ def cmd_user_add(args, app):
     password = getpass.getpass("Password: ")
     password_confirm = getpass.getpass("Confirm password: ")
 
-    if password != password_confirm:
-        print("Error: Passwords do not match.")
-        return 1
-
-    if len(password) < 8:
-        print("Error: Password must be at least 8 characters.")
+    error = validate_password(password, password_confirm)
+    if error:
+        print(error)
         return 1
 
     # Hash password and create user
@@ -102,12 +108,9 @@ def cmd_user_passwd(args, app):
     password = getpass.getpass("New password: ")
     password_confirm = getpass.getpass("Confirm password: ")
 
-    if password != password_confirm:
-        print("Error: Passwords do not match.")
-        return 1
-
-    if len(password) < 8:
-        print("Error: Password must be at least 8 characters.")
+    error = validate_password(password, password_confirm)
+    if error:
+        print(error)
         return 1
 
     user.password_hash = app.password_hasher.hash(password)