Add an env var for minimal length of vaultwarden vault passwords #909

New Issue

MrUnknownDE · 2026-04-06T00:44:30+02:00

MrUnknownDE commented

2026-04-06 00:44:30 +02:00

Originally created by @guerby on 9/30/2024

Vaultwarden Support String

N/A

Vaultwarden Build Version

1.32.0

Deployment method

Official Container Image

Custom deployment method

No response

Reverse Proxy

N/A

Host/Server Operating System

Linux

Operating System Version

No response

Clients

Web Vault, Browser Extension, CLI, Desktop, Android, iOS

Client Version

No response

Steps To Reproduce

When creating a vault there is no way to force a minimun length for passwords

Expected Result

An environment variable where I can say that password for a vault must be at least 12 characters.
0 or not specified for the same behaviour as current.

Actual Result

Refuse password of length less than specified

Logs

No response

Screenshots or Videos

No response

Additional Context

NIST has recently updated guidelines with only the length left as constraint, see below for more

Verifiers and CSPs SHALL require passwords to be a minimum of eight characters in length and SHOULD require passwords to be a minimum of 15 characters in length.

Before the change : https://pages.nist.gov/800-63-3/sp800-63b.html

"Verifiers SHOULD NOT impose other composition rules (e.g., requiring mixtures of different character types or prohibiting consecutively repeated characters) for memorized secrets. "

After the change: https://pages.nist.gov/800-63-4/sp800-63b.html

"Verifiers and CSPs SHALL NOT impose other composition rules (e.g., requiring mixtures of different character types) for passwords."

So advice to requirement for this part, which is great!

*Originally created by @guerby on 9/30/2024* ### Vaultwarden Support String N/A ### Vaultwarden Build Version 1.32.0 ### Deployment method Official Container Image ### Custom deployment method _No response_ ### Reverse Proxy N/A ### Host/Server Operating System Linux ### Operating System Version _No response_ ### Clients Web Vault, Browser Extension, CLI, Desktop, Android, iOS ### Client Version _No response_ ### Steps To Reproduce When creating a vault there is no way to force a minimun length for passwords ### Expected Result An environment variable where I can say that password for a vault must be at least 12 characters. 0 or not specified for the same behaviour as current. ### Actual Result Refuse password of length less than specified ### Logs _No response_ ### Screenshots or Videos _No response_ ### Additional Context NIST has recently updated guidelines with only the length left as constraint, see below for more Verifiers and CSPs SHALL require passwords to be a minimum of eight characters in length and SHOULD require passwords to be a minimum of 15 characters in length. Before the change : https://pages.nist.gov/800-63-3/sp800-63b.html "Verifiers SHOULD NOT impose other composition rules (e.g., requiring mixtures of different character types or prohibiting consecutively repeated characters) for memorized secrets. " After the change: https://pages.nist.gov/800-63-4/sp800-63b.html "Verifiers and CSPs SHALL NOT impose other composition rules (e.g., requiring mixtures of different character types) for passwords." So advice to requirement for this part, which is great!

MrUnknownDE closed this issue

2026-04-06 00:44:30 +02:00

Sign in to join this conversation.

No Label bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github/vaultwarden#909