What is a Password Policy?

A password policy defines how users and applications handle passwords. It covers more than minimum length and permitted characters: reuse, checks against known leaks, storage, login attempts and account recovery also belong in the policy. Its purpose is reliable authentication, not the most complicated rule possible.

What belongs in a modern password policy?

• Sufficient length:
  Permit long passwords and passphrases while defining a sensible minimum length.
• Compromise checks:
  Reject common, predictable and demonstrably compromised passwords.
• Password managers:
  Allow pasting and support the use of an approved password manager.
• Uniqueness:
  Use a separate password for every service and prevent immediate reuse of old passwords.
• Secure recovery:
  Protect reset and support procedures at least as carefully as authentication.

Length or complexity?

Longer passwords provide a larger search space and are often easier to remember as passphrases. Rigid requirements for an uppercase letter, digit and symbol commonly lead to predictable variants: “Password” becomes “Password1!”. Attackers know these patterns and account for them when guessing. Applications should process ordinary characters correctly, accept long input and never truncate it silently.

A password manager can generate long, random and unique values. Its master password must itself be strong, and the vault should be protected with MFA. Shared spreadsheets, browser notes or reused team passwords are not suitable substitutes.

When must passwords be changed?

Routine forced changes without a specific reason commonly produce weak variations and add effort without a matching security benefit. A change is necessary when a password has been exposed, suspicious access occurred, a device is compromised or a shared account is no longer required. After an incident, active sessions and possibly recovery codes must also be invalidated.

How must applications protect passwords?

Passwords must not be stored in plaintext or with a fast general-purpose hash. Applications should use a deliberately expensive password-hashing function with an individual salt. Identical passwords in a stolen database are then not immediately recognizable, and bulk guessing becomes more expensive. Transport encryption additionally protects a password on its way to the service.

Which complementary controls matter?

Technical requirements should be communicated clearly and reviewed for their actual effect. If users routinely bypass the rules, the policy is not effective in practice, even if it appears especially strict on paper.