Password policy

The same policy applies to every password — at the registration, at the reset, and at the change in the Profile tab. The system examines every new password against the policy and rejects it with a message as soon as a rule is broken.

Rules

A password must fulfil the following rules:

Policy	Requirement
Length	At least 12 characters
Capital letters	At least one capital letter
Small letters	At least one small letter
Digits	At least one digit
Special characters	At least one special character

The following characters count as special characters:

#()^,.<>/\|{}[]-=_+$@!%*?&

Note

The minimum length is adjustable on the server through the PASSWORD_MIN_LENGTH environment variable. Without a value for the variable, the value 12 applies.

Check during the entry

As soon as you fill in a password field, the list of the rules is below the field. Rules that are fulfilled are marked:

• ■ At least [number] characters
• ■ At least one uppercase character
• ■ At least one lowercase character
• ■ At least one number
• ■ At least one special character ([characters])

A button at the right edge of the field shows and hides the password. The tooltip changes between Show password and Hide password.

Confirmation and reuse

In addition to the rules, the following applies:

• ■ The confirmation must agree with the new password.
• ■ A password that was used recently is rejected. At the reset and at the change, the system compares the new password with the passwords that were used last for the account. At the registration, the check does not apply, because no earlier password exists yet.

Messages

The following messages can occur:

Message	Cause
Your password does not meet the requirements.	The password breaks a rule for the length or the composition.
The passwords do not match.	The new password and the confirmation do not match.
Passwords do not match.	The confirmation differs from the new password. The message is directly below the confirmation field, before the form is sent.
This password was used recently. Please choose a different one.	The password has already been used for this account.
The current password is incorrect.	During the change, the previous password was entered incorrectly.
Too many attempts. Please try again later.	Too many attempts in quick succession.
Password login is not enabled for this account.	The account logs in through a provider.
Your password reset link has expired. Please request a new one.	The link for the reset has expired.
This password reset link is invalid. Please request a new one.	The link for the reset is invalid.
We couldn't find an account for that email address.	No account exists for the email address.

Warning

A password alone does not give the account sufficient protection. Also set up a passkey or the two-factor authentication.

See Change password.

See Reset password.