Password settings: "changing this may have far-reaching or unintended consequences for your site"

[BernardPaulus]

Dear Discourse Community,

On our self-hosted instance of Discourse, we’d like to increase the minimal count of unique characters, but we are faced with this scary warning:

Does this warning imply anything else than:

1. users with non-complying passwords will need to update them on next login
2. only the users with non-complying passwords will need to update them

?

I obviously searched before posting and read the OG blog post on Password Rules Are Bullshit

[ondrej]

Hey @BernardPaulus

After some research with Discourse AI it appears that:

• Changing the “Password unique characters” site setting will only enforce the new requirement for passwords set after the change.
  • Existing users with passwords that do not comply with the new requirement will NOT be forced to update their passwords upon their next login.
  • Accounts are NOT “broken” for existing users; they will still be able to log in with their current (possibly non-complying) passwords.
  • The stricter password rule will only be applied the next time a user changes or resets their password.

This answer seems to be backed up by this topic

Changing password requirements

Hello, I want to change our password requirements to 12 letters. Are legacy passwords affected, eg will users be prompted to change their passwords? Thanks in advance

[BernardPaulus]

hey @ondrej ,

I had missed that, thank you!

To quote the post you linked:

The easiest (for you) solution would be to expire all of the passwords and have everyone reset them.