Password Policy

SWITCH edu-ID passwords must meet the following requirements:

  • Minimum length: The passwort must consist of at least 10 characters.
  • Complexity: Depending on the length of the password, several character classes must be used (lower case character, uppercase characters, digits, punctuation symbols)
  • Patterns: The password must not contain repetetive characters (e.g. "aaaa", "1111"), sequences (e.g. "1234", "abcde") and common keyboard patterns (e.g. "qwertz", "asdf")
  • Leaked passwords: Passwords must not be in the Have I been Pwned Passwords database of more than 600 million leaked passwords. The passwords are securely checked via k-anonymity API.

As suggested by the NIST standard (see below), no periodic password change is required.

Recommendations to Users of SWITCH edu-ID

NIST Recommendations and Further References