Password policies 

TYPO3 includes a password policy validator which can be used to validate passwords against configurable password policies.

TYPO3 ships with three preconfigured policies:

• default Used for backend and frontend users
• installTool Used for Install Tool passwords
• secretToken Used for secret token fields (e.g. webhooks, reactions)

Each policy contains both a generator and a validators section. The generator is responsible for creating passwords, while validators enforce password requirements. They are configured independently within the same policy.

A password policy can also define Password generators and Password policy validators.

The default password policy ensures that passwords meet the following requirements:

• At least 8 characters
• At least one number
• At least one upper case character
• At least one special character
• It must be different than current password (if available)

Password policies can be configured individually for both frontend and backend context. It is also possible to extend a password policy with custom validation requirements.

Password policies apply to:

• Creating a backend user during installation (installTool)
• Setting a new password for a backend user in User settings
• Resetting a password for a backend user
• Resetting a password for a frontend user
• Password fields in tables be_users and fe_users

Optionally, a password policy can be configured for custom TCA fields of the type password.

$GLOBALS['TYPO3_CONF_VARS']['BE']['passwordPolicy'] = 'default';
$GLOBALS['TYPO3_CONF_VARS']['FE']['passwordPolicy'] = 'default';

use TYPO3\CMS\Core\PasswordPolicy\Generator\PasswordGenerator;

$GLOBALS['TYPO3_CONF_VARS']['SYS']['passwordPolicies']['simple'] = [
    'validators' => [
        CorePasswordValidator::class => [
            'options' => [
                'minimumLength' => 6,
            ],
        ],
    ],
];

$GLOBALS['TYPO3_CONF_VARS']['BE']['passwordPolicy'] = 'simple';
$GLOBALS['TYPO3_CONF_VARS']['FE']['passwordPolicy'] = 'simple';

if (\TYPO3\CMS\Core\Core\Environment::getContext()->isDevelopment()) {
    $GLOBALS['TYPO3_CONF_VARS']['BE']['passwordPolicy'] = '';
    $GLOBALS['TYPO3_CONF_VARS']['FE']['passwordPolicy'] = '';
}