Description
Ensure the minimum password length for the Email provider is set to 12 characters or more, and that password requirements include a mix of character types such as lowercase and uppercase letters, digits, and symbols. This makes user passwords much harder to guess or crack.
Rationale
Short passwords can be guessed or brute-forced quickly, especially when attackers use lists of common passwords. Each extra character greatly increases the number of possible passwords. A minimum length of 12 characters, combined with required character types, makes brute-force attacks far less practical and protects user accounts.
Impact
New and changed passwords must be at least 12 characters
Makes brute-force attacks much harder
Existing users with weak passwords are asked to strengthen them
Default Value
By default, the minimum password length is 6 characters, and no specific character types are required.
Pre-Requisites
Project Owner or Admin role
Test Plan
Sign in to the Supabase Dashboard at https://supabase.com/dashboard.
Select your project.
Open Authentication in the sidebar, select Sign In / Providers, and open the Email provider.
Check the Minimum password length value.
Check the Password Requirements setting.
If the length is less than 12 or no character types are required, follow the implementation steps.
Implementation Steps
Sign in to the Supabase Dashboard at https://supabase.com/dashboard.
Select your project.
Open Authentication in the sidebar, select Sign In / Providers, and open the Email provider.
Set Minimum password length to 12 or more.
Set Password Requirements to require lowercase, uppercase, digits, and symbols.
Select Save.
Backout Plan
Sign in to the Supabase Dashboard at https://supabase.com/dashboard.
Select your project.
Open Authentication in the sidebar, select Sign In / Providers, and open the Email provider.
Set Minimum password length and Password Requirements back to their previous values.
Select Save.
Reference