# Ensure minimum password length is 12+ characters

- Source: https://support.icompaas.com/support/solutions/articles/a_1790103906236523-ensure-minimum-password-length-is-12-characters
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Supabase cloud](https://support.icompaas.com/support/solutions/c_1790103054038308) › [supabase checks](https://support.icompaas.com/support/solutions/folders/f_1790103067540538)
- Last updated: 2026-09-22
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure the minimum password length for the Email provider is set to 12 characters or more, and that password requirements include a mix of character types such as lowercase and uppercase letters, digits, and symbols. This makes user passwords much harder to guess or crack.

**Rationale**

Short passwords can be guessed or brute-forced quickly, especially when attackers use lists of common passwords. Each extra character greatly increases the number of possible passwords. A minimum length of 12 characters, combined with required character types, makes brute-force attacks far less practical and protects user accounts.

**Impact**

-   New and changed passwords must be at least 12 characters
    
-   Makes brute-force attacks much harder
    
-   Existing users with weak passwords are asked to strengthen them
    

**Default Value**

By default, the minimum password length is 6 characters, and no specific character types are required.

**Pre-Requisites**

-   Project Owner or Admin role
    

**Test Plan**

1.  Sign in to the Supabase Dashboard at [https://supabase.com/dashboard](https://supabase.com/dashboard).
    
2.  Select your project.
    
3.  Open Authentication in the sidebar, select Sign In / Providers, and open the Email provider.
    
4.  Check the Minimum password length value.
    
5.  Check the Password Requirements setting.
    
6.  If the length is less than 12 or no character types are required, follow the implementation steps.
    

**Implementation Steps**

1.  Sign in to the Supabase Dashboard at [https://supabase.com/dashboard](https://supabase.com/dashboard).
    
2.  Select your project.
    
3.  Open Authentication in the sidebar, select Sign In / Providers, and open the Email provider.
    
4.  Set Minimum password length to 12 or more.
    
5.  Set Password Requirements to require lowercase, uppercase, digits, and symbols.
    
6.  Select Save.
    

**Backout Plan**

1.  Sign in to the Supabase Dashboard at [https://supabase.com/dashboard](https://supabase.com/dashboard).
    
2.  Select your project.
    
3.  Open Authentication in the sidebar, select Sign In / Providers, and open the Email provider.
    
4.  Set Minimum password length and Password Requirements back to their previous values.
    
5.  Select Save.
    

**Reference**

-   [https://supabase.com/docs/guides/auth/password-security](https://supabase.com/docs/guides/auth/password-security)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.