I just installed and configured Password policy module, but the constraints like password length should be minimum 8 characters is not reflecting when a system admin adds a new user and creates an one time login password.

The constraints/plugins provided in Drupal 8 by the Password policy module aren't working in any scenario. Can anyone suggest the possible cause or the right way of using password policy module?

This module also doesn't modify the default recommendations on /admin/people/create.

Recommendations to make your password stronger:

  • Make it at least 12 characters
  • Add lowercase letters
  • Add uppercase letters
  • Add punctuation
  • not working in any scenario So it doesn't work when anonymous users sign up? – No Sssweat Oct 18 '17 at 8:35
  • I think these constraints should be applicable at user edit page, when system administrator creates a new user, and alots him password. Please correct me if I'm wrong. – Sugandh Khanna Oct 18 '17 at 8:45
  • Are you user 1? if yes, could be that since you're super user the constrains don't apply to you. Test with another admin that is not user/1. See Enforce password policy for admin (user 1) account – No Sssweat Oct 18 '17 at 8:54

Please see the reference link below which has information about how to use this module for Drupal 8


  1. There might be other modules like PRLP (Password reset landing page) or other relevant password setting modules that might not be allowing the policy to be enforced.
  2. You can check by uninstalling them and see if the created policy is being enforced on the default user form.
| improve this answer | |

Each type of constraint is a sub-module, so in order to add a constraint for character length, for example, you need to:

  1. Enable the module password_policy_length
  2. Add a policy at /admin/config/security/password-policy
  3. In #2 you will add individual constraints like password length

The module's README.md file contains pretty good instructions.

| improve this answer | |
  • 2
    At time of writing you also need to use the dev branch, the latest release will keep you locked in a password expiry loop – Clive Nov 2 '18 at 14:43

In the latest drupal 8 Password Policy recommendation and Password Strength is default functionality and it shows on every password field also it not force you to follow the recommended values.

You can overide the password policy recommendation and force password policy using this module Password Policy Configuration Module

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.