> ## Documentation Index
> Fetch the complete documentation index at: https://help-empuls.xoxoday.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Password policies

> Configure password policies in Empuls to enforce complexity requirements, expiry intervals, and multi-factor authentication to keep employee accounts secure.

If any of your users sign in to Empuls with a password (rather than through SSO), you can enforce a password policy that meets your organization's security requirements: minimum length, character classes, expiry, and history (preventing reuse). The policy applies to every direct-login account on the tenant. SSO users authenticate at their identity provider and aren't covered by Empuls's password policy. Configure password policy from **Admin Hub → Platform Settings → Security → Password Policy** (it's a sub-page of [security settings](/admin/security/security-settings)).

## Before you start

* You must be a **Super Admin**.
* If SSO is your only login method, only admin fallback accounts use passwords — keep policy strict for those.
* Stricter policies can cause users to forget passwords more often; pair tighter policy with [magic link / OTP](/employees/getting-started/otp-and-magic-link) so users have a passwordless fallback.

## What you can configure

| Setting | What it controls |
| - | - |
| **Minimum length** | Smallest acceptable password (default 8; recommend 12+) |
| **Require uppercase letter** | At least one A-Z |
| **Require lowercase letter** | At least one a-z |
| **Require digit** | At least one 0-9 |
| **Require special character** | At least one of `!@#$%^&*()_+-=...` |
| **Password expiry** | Days before users must change passwords (default 90; off disables expiry) |
| **Password history** | Last N passwords that can't be reused (default 5; recommended 12) |
| **Force reset on first login** | New accounts must set a new password before doing anything |
| **Lockout after failed attempts** | See [security settings](/admin/security/security-settings) for lockout config |

## Configure password policy

<Steps>
  <Step title="Open Password Policy">
    From the Security page in Platform Settings, click into the **Password Policy** card.
  </Step>

  <Step title="Set minimum length">
    Recommended: 12 characters for general use, 16+ for sensitive orgs.
  </Step>

  <Step title="Toggle complexity requirements">
    Enable uppercase, lowercase, digit, and special character requirements as needed.
  </Step>

  <Step title="Set expiry">
    Pick a number of days. Common: 90 days for regulated industries, off for orgs relying on SSO.
  </Step>

  <Step title="Set history">
    Pick how many recent passwords to block from reuse. Default 5 is fine; 12 if your auditors require it.
  </Step>

  <Step title="Save">
    The policy applies on the next password change. Existing passwords remain valid until expiry (if expiry is enabled).
  </Step>
</Steps>

## What users see

When a user changes their password (voluntarily or at expiry), Empuls shows the active policy on the change form so they know what's required. If they enter a password that doesn't meet the policy, the form shows which rules are unmet (e.g., "Password must include a special character") before submitting.

## Expired passwords

When a user's password reaches the expiry threshold:

1. They see a banner on their next sign-in: "Your password expires in N days."
2. On the day of expiry, the next sign-in forces a password change.
3. Until they change it, they can't access Empuls.

You can manually expire a specific user's password from their record on the [Manage employees](/admin/user-management/manage-employees) page (Action menu → **Force password reset**).

## Limits and gotchas

* The policy only applies to direct logins. SSO-authenticated users are not subject to it.
* Increasing policy strictness retroactively (e.g., raising minimum length from 8 to 12) doesn't invalidate existing passwords — they keep working until next change.
* History applies forward only. If you enable history with N=12, the next 12 changes start tracking; previous passwords aren't retroactively blocklisted.
* Empuls cannot recover lost passwords. Users without MFA or recovery email need an admin reset.

## Related

<CardGroup cols={2}>
  <Card title="Security settings" href="/admin/security/security-settings">
    Other security controls (MFA, sessions, IP allowlist).
  </Card>

  <Card title="SSO overview" href="/admin/user-authentication/sso-overview">
    Federation that supersedes password policy.
  </Card>

  <Card title="OTP and magic link" href="/employees/getting-started/otp-and-magic-link">
    Passwordless fallback.
  </Card>

  <Card title="Session management" href="/admin/user-authentication/session-management">
    Configure session timeouts alongside password rules.
  </Card>
</CardGroup>

<script type="application/ld+json" dangerouslySetInnerHTML={{ __html: `{"@context":"https://schema.org","@type":"HowTo","@id":"https://help-empuls.xoxoday.com/admin/user-authentication/password-policies","name":"Password policies","headline":"Password policies","description":"Configure password policies in Empuls to enforce complexity requirements, expiry intervals, and multi-factor authentication to keep employee accounts secure.","url":"https://help-empuls.xoxoday.com/admin/user-authentication/password-policies","inLanguage":"en","isPartOf":{"@type":"WebSite","name":"Empuls Help Center","url":"https://help-empuls.xoxoday.com"},"publisher":{"@type":"Organization","name":"Empuls Help Center","url":"https://help-empuls.xoxoday.com"},"step":[{"@type":"HowToStep","position":1,"name":"Open Password Policy","text":"From the Security page in Platform Settings, click into the Password Policy card."},{"@type":"HowToStep","position":2,"name":"Set minimum length","text":"Recommended: 12 characters for general use, 16+ for sensitive orgs."},{"@type":"HowToStep","position":3,"name":"Toggle complexity requirements","text":"Enable uppercase, lowercase, digit, and special character requirements as needed."},{"@type":"HowToStep","position":4,"name":"Set expiry","text":"Pick a number of days. Common: 90 days for regulated industries, off for orgs relying on SSO."},{"@type":"HowToStep","position":5,"name":"Set history","text":"Pick how many recent passwords to block from reuse. Default 5 is fine; 12 if your auditors..."},{"@type":"HowToStep","position":6,"name":"Save","text":"The policy applies on the next password change. Existing passwords remain valid until expiry..."}]}` }} />

<script type="application/ld+json" dangerouslySetInnerHTML={{ __html: `{"@context":"https://schema.org","@type":"BreadcrumbList","@id":"https://help-empuls.xoxoday.com/admin/user-authentication/password-policies#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Empuls Help Center","item":"https://help-empuls.xoxoday.com"},{"@type":"ListItem","position":2,"name":"Admin","item":"https://help-empuls.xoxoday.com/admin/admin-hub"},{"@type":"ListItem","position":3,"name":"User authentication","item":"https://help-empuls.xoxoday.com/admin/user-authentication/sso-overview"},{"@type":"ListItem","position":4,"name":"Password policies","item":"https://help-empuls.xoxoday.com/admin/user-authentication/password-policies"}]}` }} />