Password Policy Does Not Support Requiring All Four Character Types
Last Updated:
Overview
The Auth0 password policy, when set to 'good', requires a password to contain at least three of the following four character types:
- Lowercase letters
- Uppercase letters
- Numbers
- Special characters
This article clarifies whether this policy can be modified to require all four character types.
Applies To
- Auth0
- Password Policy
- Password Strength
Solution
It is not currently possible to configure the Auth0 password policy to require all four character types. This behavior is by design.
A feature request for this functionality can be submitted on the Auth0 Feedback page.
An unsupported alternative approach exists using a private Auth0 endpoint (/lo/reset). This method involves hosting a custom password reset page and creating a custom password policy checker to conform to the use case.
-
Details on this approach can be found in the GitHub repository.
-
NOTE: This is an unsupported solution. Auth0 cannot provide assistance in maintaining or troubleshooting this custom password reset flow if the behavior does not match expectations.
