Requirement: Passwords must be at least 8 characters long.
Recommendation: Encourage longer passwords or passphrases (e.g., "BlueCoffee!Table1985") for better security and memorability.
Allow passwords to include a mix of uppercase and lowercase letters, numbers, and special characters.
Do not require users to include specific character types (e.g., one uppercase, one number). Instead, promote the use of longer and more memorable passphrases.
✅ Good:
CorrectHorseBatteryStaple
❌ Poor:Password1!(too predictable)
Avoid predictable patterns or sequences, such as:
Common substitutions (e.g., P@ssw0rd)
Repeating characters (e.g., aaa111)
Keyboard patterns (e.g., qwerty, asdf1234)
Prohibit the use of:
Commonly used passwords (e.g., 123456, password)
Breached or compromised passwords
Implement a deny list based on real-world password breach data and continuously update it to reflect current threats.
Do not enforce routine password expiration (e.g., every 90 days), as this often results in weaker or predictable variations (e.g., Spring2025 → Summer2025).
Require password changes only when there is evidence of compromise, such as a data breach or suspicious activity.
Organizations on the Enterprise Plan have the flexibility to define their own custom password policy settings. This allows alignment with internal security standards or industry-specific compliance requirements.