For example, a password consists of letters, numbers, symbols.

Industry best/recommended practices (such as championed by NIST) no longer recommending requiring “LUDS” (Lower + Upper + Digit + Symbol) or any other character class requirements. They have moved strictly to minimum length restrictions as a best practice. See for example this blog post from NIST fr…

I’m not sure I understand the premise of the question? To strengthen a password you would indeed include a mix of letters in different cases, numbers and symbols. Preferably random, and unique for each site/login. A password manager is a useful tool as well. This is general password advice though,…

Maybe you have misunderstood me. What I mean is that I created a discourse forum. When new users register, I need to restrict their passwords to three types I can only adjust the length of the password from the system Settings

I think I see. You want to enforce users to have passwords that include a mix of letters, numbers, and symbols. I’m afraid I don’t know of a way to do that currently.

Well, thank you all the same Is there anyone who can solve this problem？

I think these are the only settings: [image] [image] Imho, this is a reasonable Contribute > Feature request? The downside of making passwords tougher to be acceptable is that you might exasperate users during sign-up and actually stop them completing it? The priority of this will surely vary…

Thanks.But I don’t need two-factor authentication

But maybe your users need, or want? That should be the first priority, not yours need.

Could you not mandate longer passwords and achieve the same thing? [图片]

It’s not a problem. Having arbitrary rules about what kinds of characters there are doesn’t help and just annoys users. Passwords are also checked against a known password database (or so I think I remember). It is a good bet that the people who made up the rules about passwords have spent more tim…

And there is another point too that quite often stays under radar — all of this are very anglo-centric things. What do you think… if and when I’m using short and quite easy password in finnish, in swedish, in german or actually using any other language than english, how fast a script/bot can break i…

如何强制执行用户密码复杂度？

产品支持

Stephen (Stephen) 2022 年10 月 26 日 17:06 15

NIST 在这方面确实走在了前面。例如，PCI-DSS 才刚刚将密码长度要求从 8 个字符增加到 12 个，并且仍然要求字母数字密码。

话题		回复	浏览量
Requiring STRONG password for users with ADMIN privileges Product Support	4	451	2024 年4 月 7 日
Is there a way to make the password requirements more simple? Product Support	18	4919	2018 年3 月 22 日
Unique characters in password - good or bad? Community Building	22	6581	2017 年12 月 4 日
Password settings: "changing this may have far-reaching or unintended consequences for your site" Product Support	2	117	2025 年8 月 13 日
Min Password Length vs Block Common Passwords Feature	29	5963	2020 年8 月 7 日

如何强制执行用户密码复杂度？

相关话题