---
title: "Deprecation: #69190 - Deprecate random password generator for frontend and backend users"
manual: "TYPO3 Core Changelog"
version: "main"
permalink: "https://docs.typo3.org/permalink/changelog:deprecation-69190-1770668741"
source: "Changelog/14.2/Deprecation-69190-DeprecatePasswordRulesOptionInPasswordGeneratorFieldControl.rst"
typo3-version: "14.2"
typo3-major: 14
type: "deprecation"
issue: 69190
forge: "https://forge.typo3.org/issues/69190"
tags: ["Backend", "Frontend", "PHP-API", "TCA", "NotScanned"]
rendered: "2026-10-07T06:09:20+00:00"
---

# Deprecation: #69190 - Deprecate random password generator for frontend and backend users {#deprecation-69190-1770668741}

See [forge#69190](https://forge.typo3.org/issues/69190)

## Description {#description}

The `passwordRules` option of the `passwordGenerator` field control has been
deprecated. Password generation is now configured through password policies
registered in `$GLOBALS['TYPO3_CONF_VARS']['SYS']['passwordPolicies']`.

Each password policy can define a `generator` section with a class implementing
`\TYPO3\CMS\Core\PasswordPolicy\Generator\PasswordGeneratorInterface`.
The field control references a policy by name via the new `passwordPolicy`
option instead of defining rules inline.

## Impact {#impact}

Using the `passwordRules` option in TCA field control configuration will
trigger a PHP deprecation warning. Support for `passwordRules` will be
removed in TYPO3 v15.

## Affected installations {#affected-installations}

Installations that use the `passwordGenerator` field control with the
`passwordRules` option in custom TCA configurations, for example in password
or secret token fields.

## Migration {#migration}

Replace the `passwordRules` option with a `passwordPolicy` reference.

**EXT:my_extension/Configuration/TCA/Overrides/be_users.php**

```diff
'fieldControl' => [
    'passwordGenerator' => [
        'renderType' => 'passwordGenerator',
        'options' => [
-           'passwordRules' => [
-               'length' => 20,
-               'upperCaseCharacters' => true,
-               'lowerCaseCharacters' => true,
-               'digitCharacters' => true,
-               'specialCharacters' => false,
-           ],
+           'passwordPolicy' => 'myCustomPolicy',
        ],
    ],
],
```

The referenced password policy must be registered in
`$GLOBALS['TYPO3_CONF_VARS']['SYS']['passwordPolicies']`:

**config/system/additional.php OR typo3conf/system/additional.php**

```php
$GLOBALS['TYPO3_CONF_VARS']['SYS']['passwordPolicies']['myCustomPolicy'] = [
    'generator' => [
        'className' => \TYPO3\CMS\Core\PasswordPolicy\Generator\PasswordGenerator::class,
        'options' => [
            'length' => 20,
            'upperCaseCharacters' => true,
            'lowerCaseCharacters' => true,
            'digitCharacters' => true,
            'specialCharacters' => false,
        ],
    ],
    'validators' => [],
];
```

> [!NOTE]
> For backend and frontend user password fields, the field control is now
> provided by the core automatically. If your TCA override only added the
> `passwordGenerator` field control with default rules, you can remove it
> entirely. The core uses the password policy configured in
> `$GLOBALS['TYPO3_CONF_VARS']['BE']['passwordPolicy']` and
> `$GLOBALS['TYPO3_CONF_VARS']['FE']['passwordPolicy']` respectively.

See [Feature: #69190 - Add password generator "wizard"](https://docs.typo3.org/permalink/changelog:feature-69190-1770137533) for details on password policies and
custom password generators.