Password settings: "changing this may have far-reaching or unintended consequences for your site"

[ondrej]

Hey @BernardPaulus

After some research with Discourse AI it appears that:

• Changing the “Password unique characters” site setting will only enforce the new requirement for passwords set after the change.
  • Existing users with passwords that do not comply with the new requirement will NOT be forced to update their passwords upon their next login.
  • Accounts are NOT “broken” for existing users; they will still be able to log in with their current (possibly non-complying) passwords.
  • The stricter password rule will only be applied the next time a user changes or resets their password.

This answer seems to be backed up by this topic

Changing password requirements

Hello, I want to change our password requirements to 12 letters. Are legacy passwords affected, eg will users be prompted to change their passwords? Thanks in advance