About Passwords

Password policies available in: All Editions

User Permissions Needed
To set password policies:	“Manage Users”
To reset user passwords and unlock users:	“Reset User Passwords and Unlock Users”

There are several settings you can configure to ensure that your users’ passwords are strong and secure:

Password policies—set various password and login policies, such as specifying an amount of time before all users’ passwords expire, the level of complexity required for passwords, and so on. See Setting Password Policies.
User password expiration—expire the passwords for all the users in your organization, except for users with “Password Never Expires” permission. See Expiring Passwords.
User password resets—reset the password for specified users. See Resetting Passwords.
Login attempts and lockout periods—if a user is locked out of Salesforce due to too many failed login attempts, you can unlock them. See Editing Users.

Password Requirements

A password cannot contain your User Name and cannot match your first or last name.

For all editions, a new organization has the following default password requirements:

A password must contain at least eight characters.
A password must contain at least one alphabetic character and one number.
The answer to the question posed if you forget your password cannot contain your password.
The last three passwords are remembered and cannot be reused when you are changing your password.

The password policies, including these defaults, can be updated for all editions except for Personal Edition.