Announcing Password strength: minimum length and character requirements_

Appwrite Auth already helps users pick safer passwords. You can block the reuse of recent passwords with password history, reject the most common passwords with the password dictionary, and stop users from putting their name, email, or phone number in a password. One basic control was missing: enforcing how a password is actually built, like a minimum length or requiring a number.

Today, we are announcing Password strength, a new setting in the Auth service that lets you enforce a minimum length and required character types on every password.

What password strength gives you

Password strength adds composition rules to the password checks Appwrite already runs at sign-up and on password changes:

• Minimum length: set the smallest number of characters a password is allowed to have.
• Character requirements: require an uppercase letter, a lowercase letter, a number, and a special character. Each one is an independent toggle, so you decide which apply.

The rules are evaluated when a user creates an account and whenever they change their password. A password that does not meet the configured requirements is rejected, so weak passwords never make it into your project in the first place.

Configure it from the Console

Password strength is configured per project from the Appwrite Console.

1. Open your project in the Appwrite Console.
2. Navigate to Auth in the sidebar.
3. Open the Security tab.
4. In the Password strength card, set the Minimum length and toggle the Character requirements you want to enforce.
5. Click Update to apply the changes.

From that point on, every new sign-up and password change in your project is held to the rules you set.

When to reach for it

Reach for Password strength when your app needs a baseline you can guarantee rather than a suggestion you hope users follow. A few common cases:

• Compliance and enterprise requirements: many security policies mandate a minimum length and a mix of character types. A minimum length of 8 or more with at least one number and one special character is a typical starting point.
• Reducing brute-force risk: longer passwords with a larger character set are exponentially harder to guess. Combined with rate limits, this meaningfully shrinks the attack surface.
• Layering with existing checks: Password strength sets the shape of a password, while password history, the password dictionary, and the personal data check filter out passwords that are weak for other reasons. Turning them on together gives you defense in depth.

Existing users are not locked out when you tighten the rules. Their current password keeps working, and the new requirements take effect the next time they set or change a password.

Get started with Password strength

Password strength is available in the Security tab of the Auth service. Open your project, set a minimum length and the character requirements that fit your app, and click Update.