---
title: "Feature: #97388 - Introduce configurable password policies"
manual: "TYPO3 Core Changelog"
version: "main"
permalink: "https://docs.typo3.org/permalink/changelog:feature-97388"
source: "Changelog/12.0/Feature-97388-ConfigurablePasswordPolicies.rst"
typo3-version: "12.0"
typo3-major: 12
type: "feature"
issue: 97388
forge: "https://forge.typo3.org/issues/97388"
tags: ["Backend"]
rendered: "2026-09-30T14:01:38+00:00"
---

# Feature: #97388 - Introduce configurable password policies {#feature-97388}

See [forge#97388](https://forge.typo3.org/issues/97388)

## Description {#description}

TYPO3 now includes a PasswordPolicyValidator component which can be used to
validate passwords against configurable password policies. TYPO3 now also
includes a default password policy which ensures that passwords meet
the following requirements:

-   At least 8 chars
-   At least one number
-   At least one upper case char
-   At least one special char
-   Must be different than current password (if available)

Password policies can be configured individually for both frontend and
backend context. It is also possible to extend a password policy with own
validation requirements.

As a first step, the included default password policy is applied to ext:setup
to ensure, that new passwords of backend users entered in "User Settings"
will match the default password requirements.

## Impact {#impact}

The new password of an existing TYPO3 backend user has to meet the default
password policy when set using ext:setup.

### Configuring password policies {#configuring-password-policies}

A password policy is defined in the TYPO3 global configuration. Each policy
must have a unique identifier (the identifier `default` is reserved by TYPO3)
and must at least contain one validator.

The example below shows, how the password policy with the identifier  `simple`
is configured:

```php
$GLOBALS['TYPO3_CONF_VARS']['SYS']['passwordPolicies'] = [
    'simple' => [
        'validators' => [
            \TYPO3\CMS\Core\PasswordPolicy\Validator\CorePasswordValidator::class => [
                'options' => [
                    'minimumLength' => 6,
                ],
            ],
        ],
    ],
];
```

The password policy in the example uses the `CorePasswordValidator` with the
option to require a password with a minimum length of 6 chars.

The password policy identifier is used to assign the defined password policy
to the either backend and/or frontend context. By default, TYPO3 uses the
password policy `default` as shown below:

```php
$GLOBALS['TYPO3_CONF_VARS']['BE']['passwordPolicy'] = 'default';
$GLOBALS['TYPO3_CONF_VARS']['FE']['passwordPolicy'] = 'default';
```

### Password policy validators {#password-policy-validators}

TYPO3 ships with two password policy validators, which are both used in the
default password policy.

#### \\TYPO3\\CMS\\Core\\PasswordPolicy\\Validator\\CorePasswordValidator {#typo3-cms-core-passwordpolicy-validator-corepasswordvalidator}

This validator has the ability to ensure a complex password with a defined
minimum length and 4 individual requirements.

The following options are available:

|  |  |  |  |
| --- | --- | --- | --- |
| Option | Description | Type | Default |
| `minimumLength` | Minimum length | Integer | 8 |
| `upperCaseCharacterRequired` | Upper case char check | Boolean | false |
| `lowerCaseCharacterRequired` | Lower case char check | Boolean | false |
| `digitCharacterRequired` | Digit check | Boolean | false |
| `specialCharacterRequired` | Special char check | Boolean | false |

#### \\TYPO3\\CMS\\Core\\PasswordPolicy\\Validator\\NotCurrentPasswordValidator {#typo3-cms-core-passwordpolicy-validator-notcurrentpasswordvalidator}

This validator can be used to ensure, that the new user password is not
equal to the old password. The validator must always be configured with
the exclude action `\TYPO3\CMS\Core\PasswordPolicy\PasswordPolicyAction::NEW_USER_PASSWORD`,
because it should be excluded, when a new user account is created.

### Disable password policies globally {#disable-password-policies-globally}

To disable the password policy globally (e.g. for local development) an
empty string has to be supplied as password policy for both frontend and
backend context as shown below:

```php
$GLOBALS['TYPO3_CONF_VARS']['BE']['passwordPolicy'] = '';
$GLOBALS['TYPO3_CONF_VARS']['FE']['passwordPolicy'] = '';
```

### Custom password validator {#custom-password-validator}

To create a custom password validator, a new class has to be created which
extends `\TYPO3\CMS\Core\PasswordPolicy\Validator\AbstractPasswordValidator`.
It is required to overwrite the following functions:

-   `public function initializeRequirements(): void`
-   `public function validate(string $password, ?ContextData $contextData = null): bool`

Please refer to `\TYPO3\CMS\Core\PasswordPolicy\Validator\CorePasswordValidator`
for a detailed implementation example.