I just installed and configured the Password Policy module, but the constraints like password length should be minimum 8 characters is not reflecting when an administrator user adds a new user and creates an one time login password.

The constraints/plugins provided in Drupal 8 by the Password Policy module aren't working in any scenario. Can anyone suggest the possible cause or the right way of using this module?

This module also doesn't modify the default recommendations on /admin/people/create.

Recommendations to make your password stronger:

  • Make it at least 12 characters
  • Add lowercase letters
  • Add uppercase letters
  • Add punctuation
  • not working in any scenario So it doesn't work when anonymous users sign up?
    – No Sssweat
    Commented Oct 18, 2017 at 8:35
  • I think these constraints should be applicable at user edit page, when system administrator creates a new user, and alots him password. Please correct me if I'm wrong. Commented Oct 18, 2017 at 8:45
  • Are you user 1? if yes, could be that since you're super user the constrains don't apply to you. Test with another admin that is not user/1. See Enforce password policy for admin (user 1) account
    – No Sssweat
    Commented Oct 18, 2017 at 8:54

3 Answers 3


Please see the reference link below which has information about how to use this module for Drupal 8


  1. There might be other modules like PRLP (Password reset landing page) or other relevant password setting modules that might not be allowing the policy to be enforced.
  2. You can check by uninstalling them and see if the created policy is being enforced on the default user form.

Each type of constraint is a sub-module, so in order to add a constraint for character length, for example, you need to:

  1. Enable the module password_policy_length
  2. Add a policy at /admin/config/security/password-policy
  3. In #2 you will add individual constraints like password length

The module's README.md file contains pretty good instructions.

  • 2
    At time of writing you also need to use the dev branch, the latest release will keep you locked in a password expiry loop
    – Clive
    Commented Nov 2, 2018 at 14:43

In the latest drupal 8 Password Policy recommendation and Password Strength is default functionality and it shows on every password field also it not force you to follow the recommended values.

You can overide the password policy recommendation and force password policy using this module Password Policy Configuration Module

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.