In practice that depends on the app quite a bit, something like http://marshmallow.readthedocs.org/en/latest/ makes validation a breeze on the backend for an API and you will need the database for more complex ones anyway. Again that probably depends on the app, but the only duplication in mine right now would be the password length which is a 1 character change.