Skip to main content

Password policy

Logto applies the password policy in different ways depending on how the password is created or updated:

Set up password policy​

For new users or users who are updating their password, you can set a password policy to enforce password strength requirements. Visit the Console > Security > Password policy to configure the password policy settings.

  1. Minimum password length: Set the minimum number of characters required for the password. (NIST suggests using at least 8 characters)
  2. Minimum required character types: Set the minimum number of character types required for the password. The available character types are:
    1. Uppercase letters: (A-Z)
    2. Lowercase letters: (a-z)
    3. Numbers: (0-9)
    4. Special characters: (!"#$%&'()\*+,-./:;<>=?@[]^\_`|{}~ )
  3. Breach history check: Enable this setting to reject passwords that have been previously exposed in data breaches. (Powered by Have I Been Pwned)
  4. Repetition check: Enable this setting to reject passwords that contain repetitive characters. (e.g., "11111111" or "password123")
  5. User information check: Enable this setting to reject passwords that contain user information such as username, email address, or phone number.
  6. Custom words: Provide a list of custom words (case-insensitive) that you want to reject in the password.

Password expiration​

Password expiration requires users to reset their password after a set number of days. You can also expire a specific user's password manually, for example when you know it has been leaked.

The policy is checked only after the user enters the correct password on password sign-in. Users who sign in with a verification code, social sign-in, SSO, or a passkey are not affected.

Enable password expiration​

Go to Console > Security > Password policy and find the Password expiration card:

  1. Turn on Enable password expiration.
  2. Set Password valid period (days), between 1 and 9999 days.
  3. Save the changes.

The toggle stays disabled until the sign-in experience has at least one forgot password method (email or phone) with a working connector, since users can only reset an expired password through that flow. For the same reason, while the policy is enabled, you can't delete the last email or SMS connector that supports forgot password. If your sign-up doesn't require an email address or phone number, some users may have no way to receive a reset code, so consider collecting one at sign-up.

Logto records when a user's password was last set or changed. When that password is as old as the valid period, the user's next password sign-in is blocked until they reset it. Users with no recorded password change date are measured from the time you enabled the policy, so turning it on does not expire everyone's password at once. Turning the policy off and on again resets this start time.

When the user sets a new password, whether through forgot password, the Account API, or the Management API, the password age restarts and any manual expiration is cleared.

Expire a user's password manually​

When the password expiration policy is enabled, you can force a specific user to reset their password on their next sign-in:

If the policy is not enabled, the API returns 400 with the error code sign_in_experiences.password_expiration_not_enabled, and the Expire button in the Console is disabled.

A common case is a password that is known to be leaked. Expiring it makes the user prove they own their email address or phone number with a verification code before they can set a new password and sign in again. If you only want to expire passwords manually and don't want to force regular rotation for all users, enable the policy with a long valid period, such as 3650 days.

Expiring a password does not sign the user out of existing sessions. To cut off access right away, also revoke the user's active sessions and authorized third-party apps.

What end users see​

When a user signs in with an expired password, after they enter the correct password, the sign-in page shows a modal with the message "Your password has expired and must be reset before you can sign in." Clicking Reset password takes the user to the forgot password flow with their identifier pre-filled. After they verify with a code sent to their email or phone and set a new password, they can sign in again.

If you build your own sign-in UI with the Experience API, the password verification request fails with the error code password.expired (HTTP 422). Handle this error by sending the user to your password reset flow.

Password compliance check​

After you update the password policy in Logto, existing users can still sign in with their current passwords. Only newly created account will be required to follow the updated policy.

To enforce stronger security, you can use the POST /api/sign-in-exp/default/check-password API to check whether a user's password meets the current policy defined in the default sign-in experience. If it doesn't, you can prompt the user to update their password with a custom flow using Account API.

Manage users Sign-up and sign-in Account settings by Account API Design your password policy