# Min password length

**URL:** https://meta.discourse.org/t/min-password-length/129518
**Category:** Support
**Created:** [September 25, 2019, 11:18pm UTC](https://meta.discourse.org/t/min-password-length/129518 "2019-09-25T23:18:20Z")
**Posts on this page:** 11
**Page:** 1

<div class="post-metadata">

### Author: ![hosna](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/hosna/32/99969_2.png) [@hosna](https://meta.discourse.org/u/hosna)
#### Post date: [September 25, 2019, 11:18pm UTC](https://meta.discourse.org/t/min-password-length/129518/1 "2019-09-25T23:18:21Z")

</div>

Why I cant reduce min password length to less than 8? 🤔

---

<div class="post-metadata">

### Author: ![Heather\_Dudley](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/heather_dudley/32/151925_2.png) [@Heather\_Dudley](https://meta.discourse.org/u/Heather_Dudley)
#### Post date: [September 25, 2019, 11:21pm UTC](https://meta.discourse.org/t/min-password-length/129518/2 "2019-09-25T23:21:58Z")

</div>

Because doing so creates more insecure passwords. Short passwords are easier to crack.

---

<div class="post-metadata">

### Author: ![Remah](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/remah/32/70590_2.png) [@Remah](https://meta.discourse.org/u/Remah)
#### Post date: [September 26, 2019, 4:57am UTC](https://meta.discourse.org/t/min-password-length/129518/3 "2019-09-26T04:57:02Z")

</div>

Why do you want to have passwords of less than 8 characters?

I’m wondering if this is a problem for you because you’re trying to do something else which requires it.

---

<div class="post-metadata">

### Author: ![hosna](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/hosna/32/99969_2.png) [@hosna](https://meta.discourse.org/u/hosna)
#### Post date: [September 26, 2019, 6:39am UTC](https://meta.discourse.org/t/min-password-length/129518/4 "2019-09-26T06:39:12Z")

</div>

> [@Heather\_Dudley](#):
>
> Because doing so creates more insecure passwords. Short passwords are easier to crack.

Ofcourse I know this. But I think admin should be able to define whatever suits for their community.

---

<div class="post-metadata">

### Author: ![Remah](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/remah/32/70590_2.png) [@Remah](https://meta.discourse.org/u/Remah)
#### Post date: [September 26, 2019, 8:49am UTC](https://meta.discourse.org/t/min-password-length/129518/5 "2019-09-26T08:49:39Z")

</div>

This is the discussion where the 8 minimum was set:

> [@Min Password Length vs Block Common Passwords](https://meta.discourse.org/t/min-password-length-vs-block-common-passwords/58207/2):
>
> 8 character passwords are perilously close to no password at all these days. [https://blog.codinghorror.com/your-password-is-too-damn-short/](https://blog.codinghorror.com/your-password-is-too-damn-short/) This is one of those defaults I strongly advise against changing, at least in the smaller direction. It is also quite telling how small the common password list is when you filter to 10 chars and higher. There is a reason for this…

---

<div class="post-metadata">

### Author: ![hosna](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/hosna/32/99969_2.png) [@hosna](https://meta.discourse.org/u/hosna)
#### Post date: [September 26, 2019, 9:47am UTC](https://meta.discourse.org/t/min-password-length/129518/6 "2019-09-26T09:47:11Z")

</div>

> [@Remah](#):
>
> This is the discussion where the 8 minimum was set:

So is there a command line for changing it as mentioned here?

> [@Min Password Length vs Block Common Passwords](https://meta.discourse.org/t/min-password-length-vs-block-common-passwords/58207/4):
>
> Fair point. Maybe we should make lower-than-10 impossible to do via the interface. Setting could only be changed by command line.

---

<div class="post-metadata">

### Author: ![Remah](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/remah/32/70590_2.png) [@Remah](https://meta.discourse.org/u/Remah)
#### Post date: [September 26, 2019, 10:07am UTC](https://meta.discourse.org/t/min-password-length/129518/7 "2019-09-26T10:07:04Z")

</div>

> [@hosna](#):
>
> command line for changing it as mentioned here?

No, but there should be a site setting.

You can use the search box on your Settings page to find settings by name. Entering “Min Password Length” into the search box should return the setting for you to change.

---

<div class="post-metadata">

### Author: ![hosna](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/hosna/32/99969_2.png) [@hosna](https://meta.discourse.org/u/hosna)
#### Post date: [September 26, 2019, 10:24am UTC](https://meta.discourse.org/t/min-password-length/129518/8 "2019-09-26T10:24:30Z")

</div>

> [@Remah](#):
>
> No, but there should be a site setting.

I’m aware of the site setting “Min Password Length”. But its been set to minimum of 8 characters. I want to reduce it even more as pointed by @erlend_sh in the quote.

---

<div class="post-metadata">

### Author: ![hosna](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/hosna/32/99969_2.png) [@hosna](https://meta.discourse.org/u/hosna)
#### Post date: [October 15, 2019, 7:21pm UTC](https://meta.discourse.org/t/min-password-length/129518/9 "2019-10-15T19:21:39Z")

</div>

So isn’t there a solution to make min password length even less from shell? 🤔

---

<div class="post-metadata">

### Author: ![system](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/system/32/443519_2.png) [@system](https://meta.discourse.org/u/system)
#### Post date: [June 23, 2023, 6:43pm UTC](https://meta.discourse.org/t/min-password-length/129518/10 "2023-06-23T18:43:18Z")

</div>



---

<div class="post-metadata">

### Author: ![Stephen](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/stephen/32/95011_2.png) [@Stephen](https://meta.discourse.org/u/Stephen)
#### Post date: [June 23, 2023, 7:05pm UTC](https://meta.discourse.org/t/min-password-length/129518/11 "2023-06-23T19:05:58Z")

</div>


