Password policy

The password policy decides what counts as an acceptable password. It applies when someone signs up, resets a password, changes it, or an administrator sets one. Existing passwords keep working until they are changed, so tightening the policy never locks anyone out.

Password policy page — Users & auth → Password policy: Strength, then Reuse and expiry.

In Studio

Users & auth → Security → Password policy. Three cards.

Strength

Setting	Meaning	Key
Policy	Length and character rules, or Also refuse common passwords	`password_policy`: `basic` or `strict`
Minimum length	Characters, 6 to 128. Default 8	`password_min_length`
Maximum length	Longer passwords are refused. 16 to 1024. Default 128	`directory.passwords.max_length`
Must contain	Any of: uppercase letter, lowercase letter, number, symbol	`password_rules`: `upper`, `lower`, `digit`, `symbol`
Different characters	At least this many distinct characters, so `aaaaaaaa1` doesn’t pass. 0 turns it off	`directory.passwords.min_unique`

Reuse and expiry

Setting	Meaning	Key
Remember previous passwords	A person cannot go back to one of their last N passwords. 0 turns it off	`directory.passwords.history`
Passwords expire after	After this many days a person must choose a new password through “Forgot password” before signing in. 0 means never	`directory.passwords.max_age_days`

Guessable passwords

Setting	Meaning	Key
Refuse passwords containing the person’s name, username or email	Stops `ada2026` for Ada	`directory.passwords.forbid_personal`
Refuse passwords found in known data breaches	Checked with haveibeenpwned’s range service: only the first five characters of a hash leave your server. If the service is unreachable, the password is accepted	`directory.passwords.breach_check`

What your app sees

A password that fails the policy is a ValidationError on the password field, with a message that says which rule failed:

try {
  await pawabase.auth.signUp({ email, password });
} catch (e) {
  if (e instanceof ValidationError) setPasswordError(e.fieldError("password"));
}

try:
    pb.auth.sign_up(email=email, password=password)
except ValidationError as e:
    show(str(e))

Show the rules before the person types: read them from your own configuration and list them under the field (“At least 12 characters”). Don’t duplicate the checks as a replacement for the server’s.

Recommended defaults

Length over complexity. 12 or more characters beats forcing symbols. Leave Must contain off.
Turn on the breach check. It is the single most effective rule against reused passwords.
Don’t expire passwords unless a regulation says you must. Forced rotation makes people pick weaker passwords.
Turn on personal-information refusal.
Allow paste in your form so password managers work.

Expired passwords

With Passwords expire after set, a person whose password is too old can’t sign in until they reset it. Their sign-in fails with an authentication error; send them to “Forgot password” (recovery).

Account recovery

Reset links.

Two-step verification

Protect accounts beyond passwords.

Getting started

Sign-in methods

Sign-up

Security

People

Developers

In Studio

Strength

Reuse and expiry

Guessable passwords

What your app sees

Recommended defaults

Expired passwords

Account recovery

Two-step verification

​In Studio

​Strength

​Reuse and expiry

​Guessable passwords

​What your app sees

​Recommended defaults

​Expired passwords

Account recovery

Two-step verification

In Studio

Strength

Reuse and expiry

Guessable passwords

What your app sees

Recommended defaults

Expired passwords