---
title: Configure password rules
description: >-
  Configure password rules for length, character types, history, and expiration
  to strengthen account security and enforce policy compliance.
lastUpdated: "2026-09-09"
---

> **For AI agents:** the complete documentation index is at [llms.txt](/llms.txt). Append `.md` to any page URL for its markdown version.

Password rules control how users create and maintain their passwords. They span three sections of the policy form: **Password Policy**, **Password history**, and **Password life**. Tick a rule's checkbox to reveal and set its values.

## Password requirements

In the **Password Policy** section, enable the rules you want to enforce:

- **Set min/max length**: minimum and maximum character count
- **Set min/max lowercase characters**
- **Set min/max uppercase characters**
- **Set min/max numerical characters**
- **Set min/max alphabetic characters**
- **Set min/max special characters**
- **Enforce maximum number of equal consecutive characters**: limit how many times the same character can repeat in a row (e.g. no "aaa")
- **Forbid password equal to username**
- **Forbid password containing username**
- **Forbid whitespaces in password**

Each character rule sets both a minimum and a maximum, so you can require *at least* a number of a character type and optionally cap it.

## Password history

In the **Password history** section:

- **Remember previous passwords**: track past passwords so they can't be reused. Set **Number of previous passwords to remember**.
- **Enforce uniqueness against previous passwords**: reject a new password that matches any remembered one.
- **Consider too old passwords as available for reuse**: allow reuse of passwords older than the remembered window.

## Password life

In the **Password life** section:

- **Enforce password change after reset**: require a password change at the next login after an admin reset.
- **Enforce password change after first login**: require a password change on a user's first login.
- **Limit password lifetime**: require users to change their password after a set period. Enabling it reveals the expiration settings.