The password quality mechanism distinguishes four types of character classes that are used to create a password:
- Uppercase letter – the letter entered in the upper case. For example, 'A', 'V'.
- Lowercase letter – the letter entered in the lower case. For example, 'a', 'v'.
- Numerics – the digit character.They are 1,2,3,4,5,6,7,8,9 and 0.
- Special character – any non-alphanumeric character. For example, '#', '&', '!'.
The mechanism includes an English vocabulary. It checks against commonly used words and impose the limitations on using them in passwords.
Basically, passwords must be at least 7 characters long and include different types of characters. Shorter passwords must contain more types of characters. Only uppercase and lowercase letters, numbers, and special characters are allowed. Avoid using dictionary words, personal information, and keyboard sequences.
The table below comprises the requirements for a MINIMUM password length depending on the number of character classes used in it:
|
4 character classes |
3 character classes |
2 character classes |
1 character class |
Pass phrase |
|
|---|---|---|---|---|---|
|
Minimum required password length |
7 symbols |
8 symbols |
24 symbols |
not allowed |
11 symbols |
Additional requirements for a password
- Only printable ASCII characters are allowed within a password; using UNICODE is unacceptable.
- Generally, basing a password on a login name is not allowed, butif the rest of the password is still strong enough then the whole password will be accepted.
- When calculating the number of character types, upper-case letters used as the first character and digits used as the last character of a password are not counted. For example, the password 'Atu157!' will not work, because it starts with the upper-case 'A', but password 'aTu157!' will pass the quality check.
- The password length contributes more to the password strength than a number of character classes used in it.
Examples
Weak passwords are listed below together with the messages displayed by Billing:
- Password: 123
- Message: The password is too short. Add more characters.
- Password: 1q2w3e4r
- Message: The password is not strong enough. Add more characters like upper and lower case letters, numbers, and special symbols.
- Password: jjjjjjjjjjjjjjjjjjjjjjjjjjjjjj
- Message:The password is not strong enough. Add more characters like upper and lower case letters, numbers, and special symbols.
- Password: 1fish23.
- Message: The password is not strong enough. Add more characters to your word-based password or replace the word with a less common character sequence.
- Password: iAmadmin12@mailserver.demo
- Message: The password matches your email address. Don’t use your first name, login name or other personal information as part of your password.
- Password: abc1234.
- Message: The password is not strong enough. Add more characters like upper and lower case letters, numbers, and special symbols. If your password contains a dictionary term, try replacing it with a less common character sequence.