Auth0 PasswordStrengthError Occurs When Creating Users Due to Flexible Password Policy

Last Updated: Jul 31, 2026

Overview

A password strength error occurs when creating users in Auth0 because the Flexible Password Policy feature sets the default minimum password length to 15 characters for new connections. Resolve this issue by updating the connection configuration via the Management API to adjust the minimum password length. The following error message appears during user creation:

com.auth0.exception.APIException: Request failed with status code 400: PasswordStrengthError: Password is too weak

Applies To

Auth0
Flexible Password Policy
Database Connections

Cause

The Flexible Password Policy feature replaces the legacy password-strength slider with the password_options configuration object on database connections. For newly created connections, the default value for password_options.complexity.min_length is 15 characters. This requires a longer password than the previous default of eight characters.

Solution

How is the minimum password length adjusted?

Update the connection through the Management API and set the minimum password length to a value between 1 and 72.

Adjust the minimum password length to eight characters by executing a PATCH request to the Management API with the provided payload.

PATCH /api/v2/connections/<connection_id>

{
  "options": {
    "password_options": {
      "complexity": {
        "min_length": 8
      }
    }
  }
}

Alternative Method to Revert to the Legacy Password Policy

Remove the password_options object from the connection configuration to fall back to the legacy slider-based password policy. This policy has a default minimum length of eight characters.

NOTE: Auth0 is phasing out the legacy password policy configuration. Auth0 recommends updating the min_length via password_options.