---
sourceDocument: Brazil Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/platform-security

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Require Minimum and Maximum Password Length

# Require Minimum and Maximum Password Length {#ariaid-title1}

Release version: Brazil  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read
Summarize  
![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI  
This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.  

## Summary of Require Minimum and Maximum Password Length

This guidance emphasizes setting strict minimum and maximum password lengths within ServiceNow instances to comply with security standards and reduce the risk of brute force attacks.
Password policies should align with the NIST 800-63B recommendations by enforcing a minimum password length of at least 15 characters and a maximum of at least 64 characters.
Show full answer Show less  

## Key Configuration Requirements

* Ensure that the **Enable password policy** field is activated (set to true) on every record in the **Password Reset Credential Stores \[pwdcredstore\]** table.
* For each password credential store, verify the associated **Password Policy \[passwordpolicy\]** record has:
  * **Minimum Password Length** set to at least 15 characters (default is 8).
  * **Maximum Password Length** set to at least 64 characters (default is 100, but should not be less than 64).

## Why This Matters

Allowing passwords shorter than 15 characters increases vulnerability to brute force attacks and leads to compliance violations. Adhering to these password length standards strengthens authentication security without negatively impacting instance functionality.

## Practical Impact for Your Instance

* Implementing these password length requirements does not cause any adverse functional effects on your ServiceNow instance.
* There are no dependencies or prerequisites beyond enabling password policies and configuring length settings properly.

## Additional Resources

For detailed steps on enabling and configuring password policies, refer to the ServiceNow documentation on enabling password policies within your instance.  
Set minimum and maximum password lengths to avoid compliance issues and reduce the risk of a successful brute force attack
Password policies define the requirements for passwords your users create on your instance. The password length must fall within the range accepted by the NIST 800-63B document.

Allowing passwords that are too short increases the risk of an attacker successfully brute forcing passwords. Shorter passwords create significant compliance violations.

Ensure that a password policy is being enforced for each password credential store in use on your instance. Ensure that the password policy mandates a minimum password length of at least 15 characters and maximum password length of
at least 64 characters.  
For each password credential store record in the Password Reset Credential Stores \[pwd_cred_store\] table:

1. Ensure that a password policy is being enforced for each password credential store in use on your instance:For each password credential store record in the Password Reset Credential Stores \[pwd_cred_store\] table, ensure
   that Enable password policy field is activated.

2. Ensure that the password policy mandates a minimum password length of at least 15 characters and maximum password length of at least 64 characters.Navigate to the Password Policy \[password_policy\] record referenced in the
   record's Password policy field. Ensure that the Minimum Password Length field is set to at least 15 and Maximum Password Length field is set to at least
   64.

3. Further instructions on configuring a password policy can be in the documentation: [Enable password policies on your instance](https://www.servicenow.com/docs/BheH4sEI3TRD2u2Tk2ZOrA "Implement password policy controls at login. Force users to change their password if the password does not meet the password policy criteria.")
{#sc-set-minimal-password-length__ol_m4v_pcn_whc}

Further instructions on configuring a password policy, see [Enable password policies on your instance](https://www.servicenow.com/docs/BheH4sEI3TRD2u2Tk2ZOrA "Implement password policy controls at login. Force users to change their password if the password does not meet the password policy criteria.").

## More information {#sc-set-minimal-password-length__section_lnh_pkf_32c}

{#sc-set-minimal-password-length__table_ajc_b43_3kb__entry__2}

| Attribute | Description |
|-|-|
| Configuration name | * Password Reset Credential Store \[pwd_cred_store\] table * Password Policy \[password_policy\] {#sc-set-minimal-password-length__ul_r5l_fb4_p3c} |
| Configuration type | * Table records * Table records {#sc-set-minimal-password-length__ul_h4j_hb4_p3c} |
| Data type | * Boolean * Integer {#sc-set-minimal-password-length__ul_ogp_3b4_p3c} |
| Recommended value | * The Enable password policy field on each Password Reset Credential Stores \[pwd_cred_store\] record must be activated(true). * The Minimum Password Length on the associated Password Policy \[password_policy\] record must be at least 15. * The Maximum Password Length on the associated Password Policy \[password_policy\] record must be equal or less than 64. {#sc-set-minimal-password-length__ul_sft_zxm_rhc} |
| Default value | * The Minimum Password Length on Password Policy \[password_policy\] records is 8 by default. * The Maximum Password Length on Password Policy \[password_policy\] records is 100 by default. {#sc-set-minimal-password-length__ul_l1s_tym_rhc} |
| Fallback value | * The fallback value of Minimum Password Length on Password Policy \[password_policy\] records is 8. * The fallback value of Maximum Password Length on Password Policy \[password_policy\] record is 100. {#sc-set-minimal-password-length__ul_mhz_wym_rhc} |
| Category | [Authentication](https://www.servicenow.com/docs/SZIHG9SfxVh2_gyMf2ec2Q "The authentication category covers the main elements of modern authentication to confirm an entity and its claims are authentic and correct, resistant to impersonation and prevent interception of passwords.") |
| Security risk | * Severity score: 5.9 * CVSS score: Medium * Security risk details: Allowing passwords that are too short increases the risk of an attacker successfully brute forcing passwords. Shorter passwords create significant compliance violations. {#sc-set-minimal-password-length__ul_g1g_3sf_xwb} |
| Functional impact | Instances don't suffer any impact from a minimum password length of 15 or maximum password length of at least 64. |
| Dependencies and prerequisites | None |
[ ]

{#sc-set-minimal-password-length__table_ajc_b43_3kb}