In a Support discussion titled Password settings: “changing this may have far-reaching or unintended consequences for your site”, BernardPaulus asks whether increasing the minimum unique characters for passwords will force existing users to update non-compliant passwords. ondrej clarifies that the new rule only applies to passwords set after the change — existing users can still log in with old passwords and will only be prompted to update them when they next change or reset their password. BernardPaulus acknowledges this and references a linked meta.discourse.org topic suggesting that the easiest way to enforce compliance across all users is to expire all passwords, requiring everyone to reset them. The original post also humorously references Jeff Atwood’s blog post Password Rules Are Bullshit. The key takeaway: modifying password uniqueness settings does not break existing accounts or force immediate password resets — it only affects future password changes.
Dear Discourse Community,
On our self-hosted instance of Discourse, we’d like to increase the minimal count of unique characters, but we are faced with this scary warning:
Does this warning imply anything else than:
?
I obviously searched before posting and read the OG blog post on Password Rules Are Bullshit 
Hey @BernardPaulus 
After some research with Discourse AI 
it appears that:
This answer seems to be backed up by this topic
hey @ondrej ,
I had missed that, thank you!
To quote the post you linked:
The easiest (for you) solution would be to expire all of the passwords and have everyone reset them.
