How can I enforce that passwords include mixed cas...
# generala
ancient-nail-23271
12/05/2025, 7:21 PMHow can I enforce that passwords include mixed case, special characters, and numbers during registration?
s
steep-lamp-91158
12/08/2025, 9:05 AM
a
ancient-nail-23271
12/08/2025, 1:24 PMThanks for the reply! I saw that documentation, but it only says how to change the minimum password length. I need to enforce additional rules such as mixed case, special characters, and numbers 🤔
s
steep-lamp-91158
12/08/2025, 1:29 PM
Best practices
Almost every service with a login offers some type of registration using a password. Therefore, there are many strategies floating around, with many of them implementing terrible and insecure patterns such as:
• Not allowing special characters in passwords.
• Not allowing the use of password managers by disabling the "paste" functionality in password fields.
• Requiring you to rotate your password every month (passwords expire).
• ...
Troy Hunt has written an excellent piece on password policies and why they recently changed and how.
Ory Identities implements a password policy that:
• Checks if a password has previously been leaked using the HIBP API,
• Checks if a password is too similar to one of the identifiers,
• Doesn't expire passwords.
steep-lamp-91158
12/08/2025, 1:30 PM
> Verifiers SHOULD NOT impose other composition rules (such as, requiring mixtures of different character types or prohibiting consecutively repeated characters) for memorized secrets. Verifiers SHOULD NOT require memorized secrets to be changed arbitrarily. However, verifiers SHALL force a change if there is evidence of compromise of the authenticator.from https://pages.nist.gov/800-63-3/sp800-63b.html, also mentioned on that docs page
a
ancient-nail-23271
12/08/2025, 2:40 PMThanks for sharing those resources! I’ve shared them internally