> For the complete documentation index, see [llms.txt](https://eventx-hq.gitbook.io/knowledge-base/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://eventx-hq.gitbook.io/knowledge-base/event-setting/security-and-compliance/eventx-password-policy-guidelines.md).

# EventX Password Policy Guidelines

Creating strong, secure passwords is essential for protecting sensitive information and systems. This guide outlines best practices for setting and managing passwords in a way that balances security and usability of your Organization account.

### **1. Minimum Password Length**

* **Requirement:** Passwords must be at least **8 characters** long.
* **Recommendation:** Encourage longer passwords or passphrases (e.g., "BlueCoffee!Table1985") for better security and memorability.

### **2. Complexity Requirements**

* Allow passwords to include a **mix of uppercase and lowercase letters, numbers, and special characters**.
* **Do not require** users to include specific character types (e.g., one uppercase, one number). Instead, promote the use of **longer and more memorable passphrases**.

> ✅ Good: `CorrectHorseBatteryStaple`\
> ❌ Poor: `Password1!` (too predictable)

* Avoid predictable patterns or sequences, such as:
  * Common substitutions (e.g., `P@ssw0rd`)
  * Repeating characters (e.g., `aaa111`)
  * Keyboard patterns (e.g., `qwerty`, `asdf1234`)

### **3. Deny List for Common Passwords**

* Prohibit the use of:
  * Commonly used passwords (e.g., `123456`, `password`)
  * Breached or compromised passwords
* Implement a **deny list** based on real-world password breach data and continuously update it to reflect current threats.

### **4. Password Expiration Policy**

* **Do not enforce routine password expiration** (e.g., every 90 days), as this often results in weaker or predictable variations (e.g., `Spring2025` → `Summer2025`).
* Require password changes **only when there is evidence of compromise**, such as a data breach or suspicious activity.

### **5. Enterprise Support**

Organizations on the **Enterprise Plan** have the flexibility to define their own custom password policy settings. This allows alignment with internal security standards or industry-specific compliance requirements.

## Frequently Asked Questions

### Q: What is the minimum password length requirement?

**A:** Passwords must be at least 8 characters long. Longer passphrases are recommended.

### Q: Does EventX enforce routine password expiration?

**A:** No, EventX does not enforce routine password expiration. Password changes are only required when there is evidence of compromise.

### Q: Can enterprise customers set their own password policies?

**A:** Yes, organizations on the Enterprise Plan can define custom password policy settings to align with their internal security standards.