Skip to content
Sign in Request a quote
Identity

What should a corporate password policy look like? A weak-password blocklist instead of complexity rules

A good password policy doesn't force "uppercase, digit, symbol"; it rejects known weak passwords, allows long passwords and limits failed attempts. This approach is both more secure and easier for employees.

3 min readPublished:

Many organizations still have the same password rule: at least one uppercase letter, one number, one symbol, and a change every 90 days. The result is just as predictable: Password1!, Password2!, Password3!. The rules are satisfied, but the password doesn't get any stronger.

Why don't complexity rules work?

Forced character classes push people toward the same patterns: a capital at the start, a number and an exclamation mark at the end. Attackers know these patterns and try them first. A forced-change requirement also leads to the password being written down somewhere, or to the trailing number simply being incremented. The US National Institute of Standards and Technology's (NIST) digital identity guideline SP 800-63B also recommends dropping these composition rules in favor of checking the password against a list of known weak passwords.

What a good password policy should include

  • Minimum length: at least 8 characters; long passwords and passphrases are allowed freely.
  • Reject known weak passwords: the most commonly tried passwords, like "123456" or "password123", aren't accepted.
  • Reject patterns: a single repeated character ("aaaaaaaa") and sequential runs ("12345678", "abcdefgh").
  • No forced periodic change: the password is only changed if a leak is suspected.
  • Attempt limit: the account is locked for a period after repeated failed attempts.
  • No sharing: no shared password is handed out for shared mailboxes; everyone signs in with their own identity.

Applying the policy step by step

  1. Write down the current rule; list which systems it applies to.
  2. Remove the complexity and forced-change requirements, and replace them with weak-password screening.
  3. Enable lockout for failed login attempts.
  4. Identify shared passwords; give each person their own access.
  5. Instead of having a manager set the password for a new employee, send an invite link that lets the person set their own password.
TipSuggest employees use long but memorable passphrases, like "four random words." Length offers more protection than a short password that looks complex.

How does DBLinx handle passwords?

  • Weak-password screening: SmartID requires at least 8 characters; it rejects very common passwords, single-character repetition and sequential runs. It doesn't force character classes.
  • The employee sets the password: An administrator doesn't set the password; the employee sets their own through an invite or password link.
  • Attempt limit: After repeated failed attempts, login is locked for 15 minutes.
  • No shared password: In SmartMail, everyone accesses shared mailboxes with their own identity; the mailbox password isn't shared.

Document: setting your passwordDocument: sending a password link

Frequently asked questions

Is it necessary to change passwords regularly?Current guidance says no. Forced change leads to weak patterns; a password should only be changed if a leak is suspected or when a person leaves.
What's the minimum number of characters?At least 8 characters is a common floor; a longer password is always better, and the policy should allow long passwords.
Does dropping the symbol requirement weaken security?No. The real protection comes from rejecting known weak passwords and limiting attempts; a symbol requirement just produces predictable patterns.

Other guides