---
title: "What are LUSID's password policies?"
slug: "what-are-lusids-password-policies-1"
updated: 2025-05-23T09:32:52Z
published: 2025-05-23T09:32:52Z
canonical: "support.lusid.com/what-are-lusids-password-policies-1"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://support.lusid.com/llms.txt
> Use this file to discover all available pages before exploring further.

# What are LUSID's password policies?

LUSID has separate password policies for [personal and for service users](/v1/docs/what-are-a-personal-user-and-a-service-user), but out-of-the-box the requirements are the same:

- Passwords must have a minimum of 12 characters.
- Passwords must include a mix of letters, numbers, uppercase and lowercase characters, and symbols.
- Passwords cannot contain part of the username.
- Accounts are locked after 10 unsuccessful attempts.
- Passwords do not expire.

> **Note**: A personal user must set up at least one [multi-factor authentication method](/v1/docs/how-do-i-set-up-multi-factor-authentication-mfa) in addition to their password.

You can call the [UpdatePasswordPolicy](https://www.lusid.com/docs/api/identity/endpoints/authentication/UpdatePasswordPolicy) API to change most aspects of the password policy for personal users, service users, or both. Note you cannot change the requirement to include a mix of letters, numbers, uppercase and lowercase characters, and symbols.

For example, to configure the password policy for personal users (specified in the URL) to mandate that passwords expire after 30 days:

```json
curl -X POST 'https://<your-domain>.lusid.com/identity/api/authentication/password-policy/Personal'
   -H 'Authorization: Bearer <your-API-access-token>'
   -H 'Content-Type: application/json-patch+json'
   -d '{
  "conditions": {
    "complexity": {
      "minLength": 12,             <-- Must be between 12 and 30
      "excludeFirstName": true,    <-- false allows first names in passwords
      "excludeLastName": true      <-- false allows last names in passwords
    },
    "age": {
      "maxAgeDays": 30,            <-- 0 means passwords never expire
      "historyCount": 4            <-- Between 0 and 30 passwords must be unique before one can be re-used
    },
    "lockout": {
      "maxAttempts": 10            <-- O means unlimited incorrect attempts allowed (max 100)
    }
  }
}'
```

To examine the password policy currently in place for personal users or for service users, call the [GetPasswordPolicy](https://www.lusid.com/docs/api/identity/endpoints/authentication/GetPasswordPolicy) API.