Enforcing Enhanced Password Security

Yurbi includes an optional Password Security setting that applies modern password rules to every password created or changed in your system. When enabled, Yurbi enforces a minimum password length, screens new passwords against lists of commonly used and publicly breached passwords, and locks accounts after repeated failed login attempts.

The rules follow the current NIST digital identity guidance (NIST SP 800-63B), which favors length and screening over traditional complexity rules. Yurbi deliberately does not require a mix of uppercase, numbers, and symbols — that approach is no longer recommended, because it reliably produces predictable passwords like Summer2026!.

To access this setting, go to Settings → Server Settings → Security Settings.

Note: Server Settings are only accessible to Yurbi administrators. If you do not see the Settings menu, contact your administrator.

Default Behavior

Yurbi is an on-premise product, and Password Security is OFF by default. An administrator can turn it on or off at any time.

Yurbi ships with Password Security off so that upgrading never unexpectedly blocks an administrator from saving a user. Turning it on is a deliberate, one-click decision.

What Password Security Enforces

When the setting is ON, every new or changed password must satisfy all of the following:

Rule	Requirement
Minimum length	At least 12 characters
Maximum length	No more than 128 characters
Leading/trailing spaces	Not allowed at the start or end of the password (spaces inside the password are fine)
Username	The password cannot contain the user's login name
Common passwords	The password cannot be one of a list of well-known weak passwords
Breached passwords	The password cannot be one that has appeared in a public data breach
Character types	No requirement. Letters, numbers, symbols, and spaces are all accepted, and none of them are mandatory

In addition, enabling Password Security activates account lockout — see Account Lockout below.

Note: Because there are no character-type requirements, a passphrase such as correct battery kitchen lamp is a perfectly valid password and is considerably harder to crack than something like Xk9$mQ2!.

Turning Password Security On

Log in to Yurbi as an administrator.
Go to Settings → Server Settings.
Select the Security Settings tab (the second tab).
Scroll to the Password Security section.
Switch Enforce Password Security to ON.
Click Save.

The change takes effect immediately across the entire Yurbi instance. There is no restart required.

What Happens After You Turn It On

This is the most important thing to understand before enabling the setting: Password Security is applied when a password is set, not retroactively.

Situation	Effect
Users who are already logged in	No effect. Active sessions continue normally
Users with existing passwords	No effect. They can keep logging in with their current password indefinitely
A user changes their own password in their profile	New rules apply
An administrator edits a user and sets a new password	New rules apply
An administrator creates a new user	New rules apply

Warning: Turning Password Security on does not force your existing users to update weak passwords. If you want every account brought up to the new standard, you will need to reset those passwords yourself as an administrator, or ask each user to change their own.

Messages Your Users Will See

If a password fails one of the checks, Yurbi rejects the save and displays a message explaining why. Only the first problem found is shown at a time.

Message	Meaning
Password must be at least 12 characters.	The password is too short
Password cannot exceed 128 characters.	The password is too long
Password cannot begin or end with spaces.	Usually caused by pasting with an accidental trailing space
Password cannot contain your username.	The login name appears somewhere in the password
This password is too common.	The password matches a known weak password
Choose a different password. This one has appeared in known data breaches.	The password was found in a public breach corpus
Account is Locked	Shown at login — see below

Account Lockout

Enabling Password Security also enables account lockout. This protects accounts against password-guessing attacks by making repeated attempts impractically slow.

How it works:

After 5 consecutive failed login attempts, the account is locked.
While locked, every login attempt is refused with Account is Locked — including attempts using the correct password.
The lock clears automatically after 5 minutes. No administrator action is required.
A successful login clears the failed attempt count.

The 5-attempt threshold and the 5-minute duration are fixed and cannot be changed.

Note: The lock is deliberately short. Its purpose is to slow an attacker down to a rate that makes guessing futile, not to shut a legitimate user out of their account for the rest of the day. A user who simply mistyped their password a few times only needs to wait a few minutes and try again.

Warning: Yurbi does not currently offer a self-service "Forgot Password" option. If a user genuinely does not know their password, waiting out the lock will not help — an administrator needs to set a new password on their record. Make sure you have at least two administrator accounts so that an administrator who forgets their own password can be helped by a colleague.

The built-in yurbi and scheduler service accounts are exempt from lockout so that scheduled reports and internal processes are never interrupted by it.

If a user reports being locked out repeatedly

Ask them to wait the full five minutes before trying again, and to have the correct password ready — ideally pasted from a password manager rather than typed. Attempting again too early, or with another guess, restarts the wait.

Network Requirement: Breach Screening

The breached-password check works by consulting the public Have I Been Pwned password database over the internet. Yurbi needs outbound HTTPS access for this feature:

Setting	Value
Destination	`api.pwnedpasswords.com`
Protocol / Port	HTTPS / 443
Direction	Outbound only, from the Yurbi application server

Your users' passwords are never transmitted. Yurbi hashes the password locally, sends only the first five characters of that hash, and receives back a list of hash fragments to compare against on your own server. This technique — known as k-anonymity — means the service on the other end never learns the password, the full hash, or which user it belongs to.

Note: If outbound access is blocked by your firewall, or the service is unreachable, Yurbi allows the password rather than blocking the user. All other checks — length, username, and the common password list — continue to work normally. If you operate a fully air-gapped installation, plan for the breach check to be inactive.

If your security policy does not permit this outbound call, allowlist api.pwnedpasswords.com or contact support@yurbi.com to discuss alternatives.

Turning Password Security Off

Go to Settings → Server Settings → Security Settings.
Switch Enforce Password Security to OFF.
Click Save.

Password rules and account lockout stop being enforced immediately. Passwords that were already set under the stricter rules are unaffected and continue to work. Any account that is currently locked is released as soon as the setting is off, because the lockout check no longer runs.

Helping Users Choose a Good Password

Because the 12-character minimum is longer than many people are used to, it helps to give users a strategy rather than just a rule:

Use a passphrase. Four or five unrelated words — maple lantern harbor quiet — is easy to remember, easy to type, and far stronger than a short password with substitutions.
Longer beats more complicated. A 20-character phrase of ordinary words is harder to crack than a 10-character string of symbols.
Don't reuse a password from another site. This is exactly what the breach check catches. If Yurbi reports that a password has appeared in a data breach, that password is circulating publicly and should not be used anywhere.
Avoid the obvious patterns. Company name, season and year, product names, and keyboard runs are the first things attackers try.
A password manager helps. Yurbi accepts pasted passwords and works normally with password managers.

Frequently Asked Questions

Will my existing users be forced to change their passwords? No. Existing passwords keep working. Password Security only applies when a password is being created or changed.

Why doesn't Yurbi require an uppercase letter and a symbol? Current NIST guidance specifically advises against composition rules. In practice they push people toward predictable patterns and make passwords harder to remember without making them meaningfully harder to guess. Length plus breach screening is more effective.

Can I change the 12-character minimum? Not at present. The setting is a single on/off toggle.

Does this affect users who sign in with SSO? These rules apply to passwords stored in Yurbi. Users authenticating through an external identity provider are governed by that provider's password policy.

A user is locked out and needs access right now. What do I do? The lock clears by itself after 5 minutes, so waiting is usually the fastest option. If they've forgotten the password entirely, edit their user record and set a new one.

Can I change the lockout threshold or duration? No. Both the 5-attempt threshold and the 5-minute lock are fixed.

Does the lockout apply to the Yurbi service accounts? No. The built-in yurbi and scheduler accounts are excluded so that internal and scheduled operations are not disrupted.