---
title: "Enforce a strong password policy"
slug: "enforce-a-strong-password-policy"
abstract: "How to enforce a strong password policy on Sitecore Core roles."
---
# Enforce a strong password policy

| **Applies to** | All [core roles](https://doc.sitecore.com/xp/en/developers/104/platform-administration-and-architecture/roles-overview.html) |
| --- | --- |

Sitecore uses the Microsoft ASP.NET Membership Provider as the out-of-the-box user management system. Sitecore recommends that you change the password policy to one that works for your organization.

In the `web.config` file, in the `<membership>` section, you can set the following properties:

- `minRequiredPasswordLength`
- `minRequiredNonAlphanumericCharacters`
- `maxInvalidPasswordAttempts`
- `passwordAttemptWindow`
- `passwordStrengthRegularExpression`

For more information, see:

- [Configure the password policy](https://doc.sitecore.com/xp/en/developers/104/platform-administration-and-architecture/configure-the-password-policy.html "Configure the password policy")
- [Membership Properties](https://msdn.microsoft.com/en-us/library/system.web.security.membership_properties(v=vs.110).aspx)