Timeline for Is it possible to reduce the minimum character length for passwords?
Current License: CC BY-SA 3.0
10 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| May 31, 2022 at 22:43 | comment | added | OG Sean | @McOwen Did you ever find out what was setting this? I have the same issue and cannot find what is setting this minimum. I use Wordfence, SG Security, UsersWP, and LoginPress to name a few plugins that I thought might be doing it but I don't see it in their settings anywhere... | |
| Jul 27, 2018 at 5:56 | comment | added | William | @McOwen I find it very confusing too, it mislead user to think that "IT IS A MUST" to have 12 character long password to register an account. But actually it's just an indicator that in order to have a strong password, we need a 12 character long password. | |
| Aug 25, 2017 at 16:12 | answer | added | ClintonGallagher | timeline score: 1 | |
| Aug 25, 2017 at 13:16 | comment | added | Jacob Peattie | That's not something WordPress does. That's coming from somewhere else. | |
| Aug 25, 2017 at 13:08 | comment | added | McOwen | @JacobPeattie so why when a user tries to enter a password do we get a message saying "Passwords must be a minimum of 12 characters long"? | |
| Aug 25, 2017 at 11:29 | comment | added | Jacob Peattie | Passwords do not have a minimum character requirement, but there is an minimum strength requirement. The strength is determined by zxcvbn. There are plugins that let you change the strength requirements however, like this one: wordpress.org/plugins/wc-password-strength-settings | |
| Aug 25, 2017 at 11:00 | comment | added | kero | Just checked, at least as admin there is no such restriction. However, you have to tick the "Confirm use of weak password" checkbox | |
| Aug 25, 2017 at 11:00 | comment | added | Tom J Nowell♦ | Consider mnemonics and password managers. The XKCD method of 4 silly words still generates lengthy passwords that're easy to remember, e.g. "correct-horse-staple-battery" xkcd.com/936 | |
| Aug 25, 2017 at 10:59 | comment | added | Tom J Nowell♦ | 8 is not a reasonable number. Reducing those minimums has significant security impacts, at 8 characters it could take less than 6 hours to crack. Most likely significantly less with the right compute cluster ( nothing AWS couldn't provide ). 8 characters also makes a lot more simple dictionary passwords possible, which could cut down the attack time to minutes or even seconds. | |
| Aug 25, 2017 at 10:52 | history | asked | McOwen | CC BY-SA 3.0 |