Enforcing Enhanced Password Security
Enforce password security is a setting that applies modern password rules to every password created or changed in Yurbi: a minimum length, and screening against common and publicly breached passwords. It follows NIST SP 800-63B, which favors length and screening over complexity rules — there is deliberately no requirement for uppercase letters, numbers or symbols, because those rules tend to produce predictable passwords.
The setting lives under Settings → Server Settings → Security Settings. Only administrators can open Server Settings.
Default behavior
On a self-hosted server the setting is off by default, so an upgrade never unexpectedly blocks an administrator from saving a user. Turning it on is a deliberate choice. When it is off, the only rule is that a password cannot be blank.
Account lockout — blocking sign-in after repeated wrong passwords — is a separate switch on the same page and is also off by default. See Account Lockout.
What password security enforces
When the setting is on, every new or changed password must meet all of these:
Rule | Detail |
|---|---|
Minimum length | 12 characters |
Maximum length | 128 characters |
Spaces | Allowed inside the password; leading and trailing spaces are removed before the password is saved |
Username | Must not contain the user's login name |
Common passwords | Must not match a list of well-known weak passwords |
Breached passwords | Must not appear in a public data breach (see below) |
Character types | No requirement — letters, numbers, symbols and spaces are all optional |
A passphrase of four or five ordinary, unrelated words passes every rule and is far harder to guess than a short string of symbols.
Where the rules apply
The rules are enforced wherever a password is set:
My Profile → Change password (the user changes their own)
The Change password dialog in Settings → Security → Users
The Create / Edit user editor
The self-service reset page and the set your password page from a welcome email
On each of these a one-line hint appears under the password field — At least 12 characters. Any letters, numbers, symbols or spaces — a passphrase of four or five random words works well. — and the reset and welcome pages list the full rules. When the setting is off, none of this is shown.
Turning password security on
Sign in as an administrator.
Go to Settings → Server Settings and open the Security Settings tab.
Under Sign-in Security, turn on Enforce password security.
Click Save.
The rules apply immediately; no restart is needed.
What happens after you turn it on
The rules apply when a password is set, not retroactively.
Situation | Effect |
|---|---|
Users who are signed in | None; their sessions continue |
Users with existing passwords | None; they keep their current password until they change it |
A user changes their own password | The rules apply |
An administrator sets a user's password | The rules apply |
An administrator creates a user | The rules apply |
A user sets a password from a reset or welcome link | The rules apply |
Requiring existing users to update. Turning the setting on does not make anyone change a weak password. To require it for one user, turn on Require password change at next login in the user editor (Managing User Accounts). To require it for all users, or every user whose password is older than a number of days, use the ForcePasswordResetAll call described in the API documentation. Service accounts are skipped by both.
Messages your users will see
If a password fails more than one rule, every failure is listed in one message so the user can fix them all at once. The messages are written to say what to do, not just what went wrong:
Message says | Meaning |
|---|---|
Too short / too long | Fewer than 12 or more than 128 characters |
Cannot contain your username | The login name appears inside the password |
Too common | It matches the well-known-passwords list; try a passphrase of several unrelated words |
Found in a data breach | It is circulating publicly; choose something you have never used anywhere else |
Cannot be blank | Only spaces were entered |
Breach screening and network access
Breach screening uses the public Have I Been Pwned password database. Your Yurbi application server needs outbound HTTPS access to:
Host | Port | Direction |
|---|---|---|
| 443 | Outbound from the application server only |
Passwords are never sent anywhere. Yurbi hashes the password locally, sends only the first five characters of the hash, receives the matching hash fragments and compares them locally. The service never learns the password, the full hash or which user it belongs to.
If the service cannot be reached — a firewall blocks it, or the server has no internet access — the password is allowed and a warning is written to the server log; the length, username and common-password checks still run. Air-gapped installations should expect the breach check to be inactive. If your security policy forbids the call, allowlist the host or contact support.
Turning password security off
Go to Settings → Server Settings → Security Settings.
Turn off Enforce password security.
Click Save.
The rules stop immediately. Existing passwords keep working. Account lockout is a separate switch and is unaffected.
Helping users choose a good password
Use a passphrase of four or five unrelated words.
Longer beats more complex: a long phrase of ordinary words is stronger than a short string of symbols.
Never reuse a password from another site. A breach-screening rejection means that password is already public.
Avoid obvious patterns: the company name, the season and year, product names, keyboard runs.
Password managers work well; pasted passwords are accepted.
Frequently asked questions
Will existing users be forced to change their passwords? No. The rules apply only when a password is created or changed. Use Require password change at next login or the bulk API option if you want to force it.
Why is there no uppercase or symbol requirement? NIST advises against composition rules; they push people toward predictable patterns like Summer2026!. Length plus breach screening is more effective.
Can I change the 12-character minimum? No. The setting is a single on/off switch.
Does it affect SSO or Windows users? No. The rules apply only to passwords stored in Yurbi. Users who sign in through an identity provider follow that provider's policy.
Does the reset page follow these rules? Yes. The self-service reset page and the welcome (set-your-password) page enforce the same rules and list them on the page.
Can I see when a user last changed their password? Every password change is recorded in Settings → Audit Log, including whether the user changed it, it was a forced change, or an administrator set it.
A user is locked out after wrong passwords. That is Account Lockout, a separate setting. The lock clears after 5 minutes, or an administrator can unlock the user from the Users list. If the password is forgotten, the user can request a reset link if self-service reset is on, or an administrator can send one from the user editor.