Password and lockout policy

The password and lockout settings are per project, in the configuration editor under Users › Policies.

Password

Setting	Default	Range in the form	Range accepted by the server
Minimum length	8	6–64	4–128
Previous passwords that cannot be reused	5	0–24	0–24
Uppercase required	On
Digit required	On

Lockout

Setting	Default	Range in the form	Range accepted by the server
Failed attempts	5	3–20	1–100
Lockout duration (minutes)	15	1–1440	1–10080

After the set number of failed attempts in a row, the account is locked for the lockout duration. A successful sign-in resets the count. The end of a lockout does not reset it: the next failed attempt locks the account again.

Sign-in rate limit

Independently of the lockout policy, the server accepts at most 10 failed sign-in attempts in 10 minutes for the same user name in a project. Successful sign-ins are not counted. This limit is fixed.

The root password

The root account does not follow the policy of a project. Its password rule is fixed: at least 12 characters, an uppercase letter, a lowercase letter and a digit, and not containing the user name. Root may change its own password on the home page and may turn this rule off for the new password; the choice is recorded in the audit log. Its lockout uses the defaults above. See Change the root password.