---
sourceDocument: Zurich Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/zurich/platform-security

 Release :

    - zurich

ft:locale :

    - en-US

ft:publication_title :

    - Zurich Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Limit Invalid Password Reset Attempts \[Updated in Security Center 1.3 and updated in 2.0\]

# Limit Invalid Password Reset Attempts \[Updated in Security Center 1.3 and updated in
2.0\] {#ariaid-title1}

* Release version: Zurich
* 
* Updated July 31, 2025
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read

The password_reset.request.max_attempt is used to control the
maximum number of unsuccessful attempts that a user can reset or change their password before
being locked out for a specified period of time.

## More information {#sc-reset-password-request-max-attempts__section_more_information}

{#sc-reset-password-request-max-attempts__table_ajc_b43_3kb__entry__2}

| Attribute | Description |
|-|-|
| Property name | password_reset.request.max_attempt |
| Configuration type | System Properties (/sys_properties_list.do) |
| Category | [Authentication](https://www.servicenow.com/docs/yEXgEAg_NSo5KdsTitNCCA "The authentication category covers the main elements of modern authentication to confirm an entity and its claims are authentic and correct, resistant to impersonation and prevent interception of passwords.") |
| Purpose | Denotes the maximum number of unsuccessful password reset attempts that can be taken before the user is locked out of password reset process. The lockout period is determined by the value in password_reset.request.max_attempt_window. |
| Recommended value | Set to a positive integer value less than three. The default value is 3. When you determine the limit for the upper range of the property, consider the task that the user is performing. |
| Configuration type | Positive integer values |
| Security risk | (High) If the property is not set to the recommended value of "3" or other reasonable small value, then it could be possible to perform a brute force attack against the password reset process. |
| Security risk rating | 7.5 |
| References | [Configure Password Reset properties](https://www.servicenow.com/docs/ODymeokNFNPo~p~JVEf6_Q "You can specify properties that configure the Password Reset experience for end users.") |
[ ]

{#sc-reset-password-request-max-attempts__table_ajc_b43_3kb}