---
schema_version: "1"
id: ca442c02352a44d1fff1d6f1e8a8719c96bdcaafd99a3b8dd12b875afd1bb91e
title: Set Password Policies
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/xcloud/264-0-0/admin_password.md
canonical_url: https://help.salesforce.com/s/articleView?id=xcloud.admin_password.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: e46938b315d5212f456d606aa5d65c80e0221138a1f409e7182259ee72671671
description: Improve your Salesforce org’s security with password protection. You can set password history, length, and complexity requirements. You can also specify what to do when a user forgets the password.
products:
  - Security
release: "264"
---
# Set Password Policies

Improve your Salesforce org’s security with password protection. You can set password history, length, and complexity requirements. You can also specify what to do when a user forgets the password.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small edition"><colgroup><col></colgroup><tbody><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: both Salesforce Classic and Lightning Experience</td></tr><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: <strong>Contact Manager</strong>, <strong>Essentials</strong>, <strong>Group</strong>, <strong>Professional</strong>, <strong>Enterprise</strong>, <strong>Performance</strong>, <strong>Unlimited</strong>, <strong>Developer</strong>, and <strong>Database.com</strong> Editions</td></tr></tbody></table>

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small permission">
        <colgroup>
          <col style="width:50%">
          <col style="width:50%">
        </colgroup>
        <thead class="slds-text-title_caps ">
          <tr class="">
            <th scope="colgroup" class="slds-cell-wrap" colspan="2" style="text-align:center;vertical-align:top;" id="d19069e86">User Permissions
              Needed</th>
          </tr>
        </thead>
        <tbody>
          <tr class="">
            <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d19069e86 ">To set password policies:</td>

            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d19069e86 ">Manage Password Policies</td>

          </tr>
        </tbody>
      </table>

You can set different password and login policies based on the type of user. However, these policies apply to all user passwords.

- User passwords cannot exceed 16,000 bytes.
- Logins are limited to 3,600 per hour per user. This limit applies to organizations created after Summer ’08.
- A password can’t contain a user’s username and can’t match a user’s first or last name. Passwords also can’t be too simple. For example, a user can’t change their password to password.

For all editions, a new org has the following default password requirements. You can change these password policies in all editions, except for Personal Edition.

- A password must contain at least eight characters, including one alphabetic character and one number.
- The security question’s answer can’t contain the user’s password.
- When users change their password, they can’t reuse their last three passwords.

To define password policies:

1. From [Setup](https://help.salesforce.com/s/articleView?id=xcloud.basics_nav_setup.htm&type=5&language=en_US), use the Quick Find box to find and select **Password Policies**.
2. Customize the password settings.
    
    <table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small ">
            <colgroup>
              <col style="width:50%">
              <col style="width:50%">
            </colgroup>
            <thead class="slds-text-title_caps ">
              <tr class="">
                <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d19069e177">Field</th>
                <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d19069e180">Description</th>
              </tr>
            </thead>
            <tbody>
              <tr class="">
                <td data-label="Field" class="slds-cell-wrap" style="vertical-align:top;" headers="d19069e177 ">
                  <samp class="parmname" id="admin_password__field_password_expires"><a name="admin_password__field_password_expires"><!-- --></a>User passwords expire
                    in</samp>
                </td>

                <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d19069e180 ">
                  <p><span id="admin_password__password_expires_descr"><a name="admin_password__password_expires_descr"><!-- --></a>The length of time until a user password
                      expires and must be changed.</span> The default is 90 days. <span id="admin_password__NotAvailableForSelfServicePortals"><a name="admin_password__NotAvailableForSelfServicePortals"><!-- --></a>This setting isn’t available for
                      Self-Service portals.</span>
                  </p>
                  <p>Enabling the Password never expires policy overrides the User passwords
                    expire in policy.</p>
                  <p style="margin-bottom:0;"><span id="admin_password__expiration_date_updates"><a name="admin_password__expiration_date_updates"><!-- --></a>You can change this
                      setting to an expiration date that is earlier or later than the previous
                      expiration date. To remove an expiration date, select <strong class="uicontrol">Never
                        expires</strong>.</span></p>
                </td>

              </tr>
              <tr class="">
                <td data-label="Field" class="slds-cell-wrap" style="vertical-align:top;" headers="d19069e177 ">
                  <samp class="parmname">Enforce password history</samp>
                </td>

                <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d19069e180 ">Save users’ previous passwords so that they must use a new, unique
                  password when changing passwords. Password history is not saved until you set
                  this value. The default is <samp class="parmname">3 passwords remembered</samp>. You
                  cannot select <strong class="uicontrol">No passwords remembered</strong> unless you select
                  <strong class="uicontrol">Never expires</strong> for the <samp class="parmname">User passwords expire
                    in</samp> field. This setting isn’t available for Self-Service
                  portals.
                </td>

              </tr>
              <tr class="">
                <td data-label="Field" class="slds-cell-wrap" style="vertical-align:top;" headers="d19069e177 ">
                  <samp class="parmname">Minimum password length</samp>
                </td>

                <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d19069e180 "><span id="admin_password__password_min_length_descr"><a name="admin_password__password_min_length_descr"><!-- --></a>The minimum number of characters
                    required for a password.</span> When you set this value, existing users
                  aren’t affected until the next time they change their passwords. The
                  default is <samp class="parmname">8 characters</samp>.</td>

              </tr>
              <tr class="">
                <td data-label="Field" class="slds-cell-wrap" style="vertical-align:top;" headers="d19069e177 ">
                  <samp class="parmname">Password complexity requirement</samp>
                </td>

                <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d19069e180 ">
                  <p>
                    <span id="admin_password__password_complexity_descr"><a name="admin_password__password_complexity_descr"><!-- --></a>The types of characters that must be
                      used in a user’s password.</span>
                  </p>
                  <ul>
                    <li><samp class="parmname">No restriction</samp>—<span id="admin_password__no_restriction_defin"><a name="admin_password__no_restriction_defin"><!-- --></a>Has no
                        requirements and is the least secure option</span>.</li>

                    <li><samp class="parmname">Must include alpha and numeric characters</samp>—<span id="admin_password__alpha_numeric_defin"><a name="admin_password__alpha_numeric_defin"><!-- --></a>The default setting. Requires at least one
                        alphabetic character and one number</span>.</li>

                    <li><samp class="parmname">Must include alpha, numeric, and special
                        characters</samp>—<span id="admin_password__special_characters_defin"><a name="admin_password__special_characters_defin"><!-- --></a>Requires at least
                        one alphabetic character, one number, and one of the following characters:
                        <kbd>! " # $ % &amp; ' ( ) * + , - . / : ; &lt; = &gt; ? @ [ \ ] ^
                          _ ` { | } ~</kbd></span>.</li>

                    <li><samp class="parmname">Must include numbers and uppercase and lowercase
                        letters</samp>—<span id="admin_password__special_chars_2"><a name="admin_password__special_chars_2"><!-- --></a>Requires at least one number,
                        one uppercase letter, and one lowercase letter</span>.</li>

                    <li><samp class="parmname">Must include numbers, uppercase and lowercase letters, and
                        special characters</samp>—<span id="admin_password__special_chars_3"><a name="admin_password__special_chars_3"><!-- --></a>Requires at least
                        one number, one uppercase letter, one lowercase letter, and one of the
                        following characters: <kbd>! " # $ % &amp; ' ( ) * + , - . / : ;
                          &lt; = &gt; ? @ [ \ ] ^ _ ` { | } ~</kbd></span>.</li>

                    <li><samp class="parmname">Must include 3 of the following: numbers, uppercase letters,
                        lowercase letters, special characters</samp>—<span id="admin_password__special_chars_4"><a name="admin_password__special_chars_4"><!-- --></a>Requires at least three of the following options: one number, one
                        uppercase letter, one lowercase letter, and one special character
                        (<kbd>! " # $ % &amp; ' ( ) * + , - . / : ; &lt; = &gt; ? @ [ \ ]
                          ^ _ ` { | } ~</kbd>).</span></li>

                  </ul>
                  <p style="margin-bottom:0;">Only the characters listed meet the requirement. Other symbol characters
                    are not considered special characters.</p>
                </td>

              </tr>
              <tr class="">
                <td data-label="Field" class="slds-cell-wrap" style="vertical-align:top;" headers="d19069e177 ">
                  <samp class="parmname">Password question requirement</samp>
                </td>

                <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d19069e180 ">
                  <p>
                    <span id="admin_password__password_question_descr"><a name="admin_password__password_question_descr"><!-- --></a>The restrictions to place on the password
                      hint’s answer. </span>
                  </p>
                  <ul>
                    <li><samp class="parmname">Cannot contain password</samp>—Restricts the answer
                      from containing the password.</li>

                    <li><samp class="parmname">None</samp>—Places no restrictions on the answer. The
                      user must provide an answer to the password hint question. This setting is
                      the default.<p><span id="admin_password__NotAvailableForPortals"><a name="admin_password__NotAvailableForPortals"><!-- --></a>This setting is not available
                          for Self-Service portals, the Customer Portal, or partner
                          portals.</span></p>
                    </li>

                  </ul>
                </td>

              </tr>
              <tr class="">
                <td data-label="Field" class="slds-cell-wrap" style="vertical-align:top;" headers="d19069e177 ">
                  <samp class="parmname">Maximum invalid login attempts</samp>
                </td>

                <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d19069e180 ">
                  <p><span id="admin_password__password_max_invalid_attempts_descr"><a name="admin_password__password_max_invalid_attempts_descr"><!-- --></a>The number of login failures
                      allowed for a user before the user is locked out.</span> This setting isn’t
                    available for Self-Service portals.</p>
                  <p>These events count toward the number of
                    times users can try to log in with an invalid password before getting locked
                    out.</p>
                  <p>If single sign-on (SSO) is enabled, the SSO authority usually
                    handles login lockout policies for users with the Is Single Sign-On Enabled
                    permission. However, if the security token is enabled, your org’s login
                    lockout settings determine how many times users can try to log in with an
                    invalid security token before being locked out.</p>
                  <ul>
                    <li>Each time users are prompted to verify identity</li>

                    <li>Each time users incorrectly add the security token or verification code to
                      the end of their password when logging in to Salesforce via the API or a
                      client</li>

                  </ul>
                </td>

              </tr>
              <tr class="">
                <td data-label="Field" class="slds-cell-wrap" style="vertical-align:top;" headers="d19069e177 ">
                  <samp class="parmname">Lockout effective period</samp>
                </td>

                <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d19069e180 ">
                  <p><span id="admin_password__login_lockout_period_descr"><a name="admin_password__login_lockout_period_descr"><!-- --></a>The duration of the login lockout.</span>
                    The default is 15 minutes. This setting isn’t available for Self-Service
                    portals.
                  </p>
                  <p id="admin_password__active_session"><a name="admin_password__active_session"><!-- --></a>When a user is logged in to an active session
                    but is later locked out, the user remains logged in to the active
                    session.</p>
                  <p>A locked-out user must wait until the lockout period expires.
                    Alternatively, a user with the Reset User Passwords and Unlock Users
                    permission can unlock a user from Setup.</p>
                  <ul>
                    <li>From <a href="https://help.salesforce.com/s/articleView?id=xcloud.basics_nav_setup.htm&amp;type=5&amp;language=en_US" target="_blank">Setup</a>, use the Quick Find box to find and select
                      <strong class="uicontrol">Users</strong>.
                    </li>

                    <li>Select the user, and click <strong class="uicontrol">Unlock</strong>.
                      <p>This button is available only when a user is locked out.</p>
                    </li>

                  </ul>
                </td>

              </tr>
              <tr class="">
                <td data-label="Field" class="slds-cell-wrap" style="vertical-align:top;" headers="d19069e177 ">
                  <samp class="parmname">Obscure secret answer for password resets</samp>
                </td>

                <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d19069e180 ">
                  <p>Hide answers to security questions as the user types. The default is to
                    show the answer in plain text.</p>
                  <p style="margin-bottom:0;">If your org uses the Microsoft Input Method
                    Editor (IME) with the input mode set to Hiragana, when you type ASCII
                    characters, they’re converted in to Japanese characters in normal text fields.
                    However, the IME doesn’t work properly in fields with obscured text. If your
                    org’s users can’t properly enter their passwords or other values after
                    enabling this feature, disable the feature.</p>
                </td>

              </tr>
              <tr class="">
                <td data-label="Field" class="slds-cell-wrap" style="vertical-align:top;" headers="d19069e177 ">
                  <samp class="parmname">Require a minimum 1 day password lifetime</samp>
                </td>

                <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d19069e180 ">A password can’t be changed more than once in a 24-hour period. This
                  policy applies to all password changes, including password resets by Salesforce
                  admins.</td>

              </tr>
              <tr class="">
                <td data-label="Field" class="slds-cell-wrap" style="vertical-align:top;" headers="d19069e177 ">
                  <samp class="parmname">Allow use of setPassword() API for self-resets</samp>
                </td>

                <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d19069e180 ">When selected, apps can use the <code>setPassword()</code> API to change the current user’s password to a
                  specific value. Deselect this option for increased security. When deselected,
                  apps must use the <code>changeOwnPassword()</code> API
                  to prompt users to set their password value. The <code>changeOwnPassword()</code> API verifies the user’s current password before
                  allowing the change.</td>

              </tr>
            </tbody>
          </table>
3. Customize the forgotten password and locked account assistance information.
    
    ![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-security-264-0-0-production-enus/8cecd769-ab2d-4e07-addf-c4f2927925e1/images/icon_note.png)
    
    Note This setting is not available for Self-Service portals, the Customer Portal, or partner portals.
    
    <table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small ">
            <colgroup>
              <col style="width:50%">
              <col style="width:50%">
            </colgroup>
            <thead class="slds-text-title_caps ">
              <tr class="">
                <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d19069e508">Field</th>
                <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d19069e511">Description</th>
              </tr>
            </thead>
            <tbody>
              <tr class="">
                <td data-label="Field" class="slds-cell-wrap" style="vertical-align:top;" headers="d19069e508 ">
                  <samp class="parmname">Message</samp>
                </td>

                <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d19069e511 ">
                  <p>If set, the message you enter appears in the We can’t reset your password
                    email. Users receive this email when they lock themselves out by trying to reset
                    their password too many times. The text also appears at the bottom of the Answer
                    Your Security Question page when users reset their passwords. </p>
                  <p style="margin-bottom:0;">You can add the
                    name of your internal help desk or a system admin to the default text. The
                    message appears only for accounts that need an admin to reset the password.
                    Lockouts due to time restrictions get a different system email
                    message.</p>
                </td>

              </tr>
              <tr class="">
                <td data-label="Field" class="slds-cell-wrap" style="vertical-align:top;" headers="d19069e508 ">
                  <samp class="parmname">Help link</samp>
                </td>

                <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d19069e511 ">
                  <p>If set, this link displays along with the text defined in the
                    <samp class="parmname">Message</samp> field. In the We can’t reset your password email,
                    the URL displays exactly as it is typed in the <samp class="parmname">Help link</samp>
                    field. This format provides extra security because the user isn’t within a
                    Salesforce org but can still see where the link goes.
                  </p>
                  <p>On the Answer Your
                    Security Question page, the <samp class="parmname">Help link</samp> URL combines with
                    the text in the <samp class="parmname">Message</samp> field and forms a clickable link.
                    Security isn’t an issue because the user is in a Salesforce org when
                    changing passwords.</p>
                  <p>Valid protocols are:</p>
                  <ul>
                    <li>http</li>

                    <li>https</li>

                    <li>mailto</li>

                  </ul>
                </td>

              </tr>
            </tbody>
          </table>
4. Specify an alternative home page for users with the API Only User permission. After completing user management tasks such as resetting a password, API-only users are redirected to the specified URL rather than to the login page.
5. Click **Save**.

#### See Also

- [View and Edit Password Policies in Profiles](https://help.salesforce.com/s/articleView?id=platform.users_profiles_password_policies.htm&type=5&language=en_US)