Editing Password policy (section)

===Password length and formation===
{{see also|Password strength}}

Many policies require a minimum password length. Eight characters is typical but may not be appropriate.<ref>{{cite web|url=http://bugcharmer.blogspot.com/2012/09/password-complexity-requirements.html|title=Password Complexity Requirements|publisher=The Bug Charmer|date=September 7, 2012}}</ref><ref>{{cite web|url=http://bugcharmer.blogspot.com/2012/06/how-long-should-passwords-be.html|title=How long should passwords be?|publisher=The Bug Charmer|date=June 20, 2016}}</ref><ref>{{cite web | url=http://www.cnn.com/2010/TECH/innovation/08/20/super.passwords/ | title=How to create a 'super password' | work=CNN | date=August 20, 2010 | accessdate=August 31, 2016 | author=John D. Sutter}}</ref> Longer passwords are almost always more secure, but some systems impose a maximum length for compatibility with [[legacy system]]s.

Some policies suggest or impose requirements on what type of password a user can choose, such as:

*the use of both upper-case and lower-case letters ([[case sensitivity]])
*inclusion of one or more numerical digits
*inclusion of [[special characters]], such as @, #, $
*prohibition of words found in a password [[Blocklist (computing)|blocklist]]
*prohibition of words found in the user's personal information
*prohibition of use of company name or an abbreviation
*prohibition of passwords that match the format of calendar dates, [[license plate]] numbers, telephone numbers, or other common numbers

Other systems create an initial password for the user; but require then to change it to one of their own choosing within a short interval.