Overview

The console's minimum password length has been updated from 12 to 14 characters as a platform-wide security hardening measure. The change applies to every Unbxd customer and is not configurable or exempt per account.

How the New Minimum Applies

The new minimum does not retroactively invalidate any password already in place. It only takes effect at the points where a password is created or changed.

Scenario	Behavior
Existing user, existing password	No impact. Current passwords, even below 14 characters, continue to work for login indefinitely. No forced reset, no expiry.
User updates their password	The new password must be 14 or more characters.
New user signup	The password set must be 14 or more characters.
Forgot password / reset flow	The system auto generates a new password, which is always 14 characters. No extra action is needed from the user.

Nothing is forced. The requirement only applies the next time a password is created or changed, by the user or by the system.

Recommended Password Composition

Requirement	Rule
Minimum length	14 characters
Uppercase letters	At least 1 (A to Z)
Lowercase letters	At least 1 (a to z)
Numbers	At least 1 (0 to 9)
Special characters	At least 1, from an allowed set
Character repetition	No more than 2 to 3 identical characters in a row (blocks aaaa, 1111)
Username/email in password	Not allowed. The password can't contain the user's email, username, or obvious parts of their name

Common special character set:! @ # $ % ^ & * ( ) - _ + = [ ] { } : ; , . ? /

Examples:

Rejected: aaaaaaaaaaaaaa, 14 characters, but fails the uppercase, number, special character, and repetition rules.
Rejected: passwordpassword, fails the number, special character, and uppercase rules.
Accepted: Bright#Harbor92!

Good to Know
Users authenticating via SSO, for example, a client's own Azure AD, are unaffected. Their password policy is owned and enforced entirely by their own identity provider, not by the console.

Why This Changed

A longer minimum password length increases resistance to brute force and credential stuffing attacks. This is part of broader console security hardening work and lines up with standard enterprise security expectations, useful context if a client asks why this changed.

Troubleshoot & FAQ

Q. Will existing users be forced to reset their password?
A. No. Existing passwords remain valid indefinitely.

Q. Can a client get an exception or delay?
A. No. This is enforced at the platform level and is not configurable per account.

Q. Does this affect SSO users?
A. No. This does not affect SSO users.

Q. What happens on "forgot password"?
A. The system generated replacement password is automatically 14 characters.

Caveats and Limitations

Platform-wide and not configurable. No account can get an exception or delay.
SSO users are unaffected; their identity provider owns password policy, not console.
No existing password is invalidated or forced to change; the new minimum only applies going forward.
Rollout communication needs leadership sign-off before it goes out to customers, given the platform-wide impact.
The password composition requirements above are proposed, not yet confirmed as enforced. Treat them as guidance until confirmed.

Reviewer Notes

Priority	Item	Rationale	Owner
Medium	The PRD references a "transition window" or grace window for existing users ("Rohit to say the grace window"), while the base doc and the walkthrough recording both describe existing passwords as working indefinitely with no forced reset	Confirm whether a time boxed grace window exists, or whether old passwords genuinely never expire, and reconcile before publishing	Rohit
Low	The password composition rules (uppercase, lowercase, number, special character, repetition limit, username/email exclusion) appear only in the PRD, not in the walkthrough recording	Confirm these are implemented before this section is presented as shipped behavior rather than guidance	Rohit