Set Password Policies

The length of time until a user password expires and must be changed. The default is 90 days. This setting isn’t available for Self-Service portals.

Enabling the Password never expires policy overrides the User passwords expire in policy.

You can change this setting to an expiration date that is earlier or later than the previous expiration date. To remove an expiration date, select Never expires.

The types of characters that must be used in a user’s password.

• No restriction—Has no requirements and is the least secure option.
• Must include alpha and numeric characters—The default setting. Requires at least one alphabetic character and one number.
• Must include alpha, numeric, and special characters—Requires at least one alphabetic character, one number, and one of the following characters: ! " # $ % & ' ( ) * + , - . / : ; < = > ? @ [ \ ] ^ _ ` { | } ~.
• Must include numbers and uppercase and lowercase letters—Requires at least one number, one uppercase letter, and one lowercase letter.
• Must include numbers, uppercase and lowercase letters, and special characters—Requires at least one number, one uppercase letter, one lowercase letter, and one of the following characters: ! " # $ % & ' ( ) * + , - . / : ; < = > ? @ [ \ ] ^ _ ` { | } ~.
• Must include 3 of the following: numbers, uppercase letters, lowercase letters, special characters—Requires at least three of the following options: one number, one uppercase letter, one lowercase letter, and one special character (! " # $ % & ' ( ) * + , - . / : ; < = > ? @ [ \ ] ^ _ ` { | } ~).

Only the characters listed meet the requirement. Other symbol characters are not considered special characters.

The restrictions to place on the password hint’s answer.

• Cannot contain password—Restricts the answer from containing the password.
• None—Places no restrictions on the answer. The user must provide an answer to the password hint question. This setting is the default.

  This setting is not available for Self-Service portals, the Customer Portal, or partner portals.

The number of login failures allowed for a user before the user is locked out. This setting isn’t available for Self-Service portals.

These events count toward the number of times users can try to log in with an invalid password before getting locked out.

If single sign-on (SSO) is enabled, the SSO authority usually handles login lockout policies for users with the Is Single Sign-On Enabled permission. However, if the security token is enabled, your org’s login lockout settings determine how many times users can try to log in with an invalid security token before being locked out.

• Each time users are prompted to verify identity
• Each time users incorrectly add the security token or verification code to the end of their password when logging in to Salesforce via the API or a client

The duration of the login lockout. The default is 15 minutes. This setting isn’t available for Self-Service portals.

When a user is logged in to an active session but is later locked out, the user remains logged in to the active session.

A locked-out user must wait until the lockout period expires. Alternatively, a user with the Reset User Passwords and Unlock Users permission can unlock a user from Setup.

• Enter Users in the Quick Find box.
• Select Users.
• Select the user, and click Unlock.

  This button is available only when a user is locked out.

Hide answers to security questions as the user types. The default is to show the answer in plain text.

If your org uses the Microsoft Input Method Editor (IME) with the input mode set to Hiragana, when you type ASCII characters, they’re converted in to Japanese characters in normal text fields. However, the IME doesn’t work properly in fields with obscured text. If your org’s users can’t properly enter their passwords or other values after enabling this feature, disable the feature.

If set, the message you enter appears in the We can’t reset your password email. Users receive this email when they lock themselves out by trying to reset their password too many times. The text also appears at the bottom of the Answer Your Security Question page when users reset their passwords.

You can add the name of your internal help desk or a system admin to the default text. The message appears only for accounts that need an admin to reset the password. Lockouts due to time restrictions get a different system email message.

If set, this link displays along with the text defined in the Message field. In the We can’t reset your password email, the URL displays exactly as it is typed in the Help link field. This format provides extra security because the user isn’t within a Salesforce org but can still see where the link goes.

On the Answer Your Security Question page, the Help link URL combines with the text in the Message field and forms a clickable link. Security isn’t an issue because the user is in a Salesforce org when changing passwords.

Valid protocols are:

• http
• https
• mailto