Organization and profile password policies
Key Takeaway
A profile's Password Policies override the org-wide Password Policies for that profile's users.
Password Policies are the rules that decide what a valid Salesforce password looks like, how long it lasts, and what happens after too many failed logins. An admin sets org-wide Password Policies in Setup and can also set separate Password Policies on a profile.
Org-wide Password Policies
Org-wide Password Policies live in Setup under Password Policies, and you can find them with Quick Find. Setting them requires the "Manage Password Policies" permission.
The table shows what these policies control and how a new org starts.
| What the policies control | Default in a new org |
|---|---|
| Password expiration | Passwords expire every 90 days |
| Password history | Users can't reuse the last 3 passwords |
| Minimum length | At least 8 characters |
| Complexity | At least one letter and one number |
| Lockout after failed logins | Lockouts last 15 minutes |
These policies also control the help users see when they forget a password. You can change these policies in every edition except Personal Edition.