> For the complete documentation index, see [llms.txt](https://docs.couchdrop.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.couchdrop.io/security-and-governance/user-and-account-policies/password-policies.md).

# Password Policies

Learn about Couchdrop's password policy management

## Overview

Couchdrop password policies let administrators enforce password requirements across the account or for specific groups.

Password policies are managed from **Administration > Security > Policies**.

## Enforce Password Policy

Enable **Enforce password policy** to require newly created passwords to comply with Couchdrop's password policy requirements.

When enabled, Couchdrop validates new passwords against the configured policy before they can be used.

## Global Password Policy

Couchdrop includes a **Default global policy** with an **Account** scope.

This policy applies across the account unless a group-specific password policy is configured.

## Group Password Policies

Group password policies let you apply different password requirements to specific groups.

Click **Add group policy**, select the group, then configure the required password rules.

Available controls include:

* Minimum password length
* Username restrictions
* Letter and number requirements
* Dictionary word restrictions
* Uppercase and lowercase requirements
* Special character requirements
* Password expiry

Group policies are useful where different sets of users require different password rules, including environments where particular SFTP or FTP clients have limitations around password complexity.

### Password Expiry

Password policies can be configured to expire passwords.

When **Passwords will expire** is enabled for a policy, users covered by that policy must reset their password once it expires.

An expired password can be reset either by an administrator or by the user through the password reset process.