Setting the password security level

<body>
<p id="docs-hc-snippet" style="display: none;">The Recommended security level includes strict password requirements, checks against known breached passwords, and follows security best practices and industry standards. You can create a custom password security level for team members (admins and agents) if your requirements differ for these users.</p>
<div class="article-banners">
<div id="docs-wmp-link">
<a href="https://support.zendesk.com/hc/en-us/articles/5411234991258-plan" rel="noopener" target="_blank">What's my plan?</a>
</div>

<div class="article-banner" id="suite_all">
<table>
<tbody>
<tr>
<td>
<strong>All Suites</strong>
</td>
<td>Team, Growth, Professional, Enterprise, or Enterprise Plus</td>
</tr>
</tbody>
</table>
</div>

<div class="article-banner" id="support_all">
<table>
<tbody>
<tr>
<td>
<strong>Support</strong>
</td>
<td>Team, Professional, or Enterprise</td>
</tr>
</tbody>
</table>
</div>

</div>
<div id="docs-ai-summary">
<p id="docs-ai-summary-toggle">Summary: <span id="up-triangle">◀</span><span id="down-triangle">▼</span></p>
<p id="docs-ai-summary-content">You can set password security levels for team members and end users to meet your security or compliance needs. The Recommended level uses strong password rules, checks for breached passwords, and does not require expiration. You can also create a Custom password policy for team members, and admins can change the level, which may force password updates and lockouts.</p>
</div>

<div class="body">

<div class="note fastpath">
<span class="fastpathtitle">Location: </span> Admin Center &gt; Account &gt; Security</div>
<div class="p">
<div class="note attention" id="topic-1__note_vws_2vd_mjc">
<span class="attentiontitle"></span> On August 17, 2026, Zendesk
began removing the Low, Medium, and High password security levels
for team member authentication and migrating all accounts to the
Recommended security level for team members. In addition, Zendesk
updated certain custom password policy settings to align with new
standards. See the <a class="xref" href="https://support.zendesk.com/hc/en-us/articles/10752557170202" target="_blank">announcement</a> for
details.</div>
</div>
<div class="p">A password security level refers to a password's strength or complexity. The
following security level options are available:<ul class="ul" id="topic-1__ul_fcs_xxw_gkc">
<li class="li">For team members: Recommended and Custom</li>
<li class="li">For end users: Recommended, Low, Medium, and High</li>
</ul>
</div>
<p class="p">The Recommended security level includes strict password requirements, checks
against known breached passwords, and follows security best practices and
industry standards. You can create a custom password security level for team
members (admins and agents) if your requirements differ for these users.</p>
<p class="p">You can use a <a class="xref" href="https://support.zendesk.com/hc/en-us/articles/4408883587226" target="_blank">single sign-on (SSO) solution</a>
instead of Zendesk passwords. Zendesk recommends using SSO, if possible.</p>
<p class="p">This article covers the following topics:</p>
<ul class="ul" id="topic-1__ul_wtk_cxw_22b">
<li class="li"><a class="xref" href="#topic_j41_j4r_2j">About password security levels</a></li>
<li class="li"><a class="xref" href="#topic_ncf_twp_jzb">Setting a custom password security level for team members</a></li>
<li class="li"><a class="xref" href="#topic_tcn_ppr_2j">Changing the password security level</a></li>
</ul>
</div>
<div aria-labelledby="ariaid-title2" class="topic nested1" id="topic_j41_j4r_2j">
<h2 class="title topictitle2" id="ariaid-title2">About password security levels</h2>
<div class="body">
<p class="p">Many companies require complex passwords as part of their security
policies. Certain regulations, such as the General Data Protection
Regulation (GDPR), require organizations to take steps to protect
personal data, including using complex passwords.</p>
<div class="p">The Recommended password security level meets or exceeds security
requirements for most companies. When this password security level
is in place, passwords don't expire. However, passwords must meet
the following requirements:<ul class="ul" id="topic_j41_j4r_2j__ul_qys_s5p_jzb">
<li class="li">Must be at least 12 characters and not exceed 72
characters</li>
<li class="li">Must include uppercase and lowercase letters (a-z and
A-Z)</li>
<li class="li">Must include a number (0-9)</li>
<li class="li">Must include a special character (!, @, #, %, etc.)</li>
<li class="li">Must not include the word "Zendesk"</li>
<li class="li">Must not resemble an email address</li>
<li class="li">Must pass a check against a list of known breached
passwords</li>
<li class="li">Five attempts are allowed before a temporary 10-minute
lockout</li>
</ul>
</div>
<div class="p">
<div class="note" id="topic_j41_j4r_2j__note_h5n_23x_jzb">
<span class="notetitle">Note:</span> The password length limit is a
reliability measure to prevent a form of Denial-of-Service
(DoS) attack called “long password denial of service.” To
learn more about Zendesk security practices, visit the <a class="xref" href="https://www.zendesk.com/product/zendesk-security/" target="_blank">Zendesk Trust
Center</a>.</div>
</div>
<p class="p">The Low, Medium, and High password security levels for end users have
lower security requirements. Zendesk recommends changing the
security level to Recommended if you are using any of these other
levels.</p>
</div>
</div>
<div aria-labelledby="ariaid-title3" class="topic nested1" id="topic_ncf_twp_jzb">
<h2 class="title topictitle2" id="ariaid-title3">Setting a custom password security level for team members</h2>
<div class="body">
<p class="p">The Custom security level is available only for team members and can be
used if you have additional compliance requirements. If you create
your own custom password policy, Zendesk recommends that the
requirements are at least as strong as the Recommended level.</p>
<div class="p">
<div class="note" id="topic_ncf_twp_jzb__note_klh_t3l_m2c">
<span class="notetitle">Note:</span> Changes to a custom password security
policy won't impact expiration rules for existing passwords.
For example, if you change your password expiration from
<strong class="ph b">30 days</strong> to <strong class="ph b">Never</strong>, passwords for
current users will still expire after 30 days. When they
reset their password, the new expiration rule is applied.
</div>
</div>
<p class="p">Most of the custom options are self-explanatory except for the
following:</p>
<ul class="ul" id="topic_ncf_twp_jzb__ul_ink_fx5_g2b">
<li class="li">
<strong class="ph b">Number of previous passwords to reject</strong> - New passwords
must be different from the number of previous passwords you
set.</li>
<li class="li">
<strong class="ph b">Failed attempts until lockout</strong> - If a team member fails to
enter their password correctly the number of times you
specify in a row, they are locked out for a certain period
of time. They cannot sign in again until the lockout
expires.</li>
</ul>
<div class="p">
<strong class="ph b">To set a custom password security level for team members</strong><ol class="ol" id="topic_ncf_twp_jzb__ol_as3_fww_jzb">
<li class="li"><span class="ph">In <a class="xref" href="https://support.zendesk.com/hc/en-us/articles/4581766374554#topic_hfg_dyz_1hb" target="_blank">Admin Center</a>, click <img class="image" id="topic_ncf_twp_jzb__d8e293" src="https://zen-marketing-documentation.s3.amazonaws.com/docs/en/ac_account_icon.png">
<strong class="ph b">Account</strong> in the sidebar, then select <strong class="ph b">Security &gt; Team member
authentication</strong>.</span></li>
<li class="li">Select <strong class="ph b">Custom</strong> in the <strong class="ph b">Password level</strong>
drop-down.</li>
<li class="li">Click the <strong class="ph b">Edit</strong> link to set password
requirements.</li>
<li class="li">Select your custom password requirements. </li>
<li class="li">Click <strong class="ph b">Set</strong>.</li>
<li class="li">Click <strong class="ph b">Save</strong>.</li>
</ol>
</div>
</div>
</div>
<div aria-labelledby="ariaid-title4" class="topic nested1" id="topic_tcn_ppr_2j">
<h2 class="title topictitle2" id="ariaid-title4">Changing the password security level</h2>
<div class="body">
<p class="p">You must be an admin to change the password security level. When you
increase the security level, all passwords, regardless of security
level, expire in 5 days. All team members must change their
passwords to comply with the new security level.</p>
<p class="p">Increasing the password security level can cause some passwords to expire
instantly. If a password is older than 90 days and the security
level is increased to a level with an expiration restriction, that
password is considered expired. Zendesk sends email notifications to
admins and agents three days before a password expires, and then on
the day it expires. End users don’t get any emails notifying them
that their password will expire.</p>
<p class="p"><strong class="ph b">To change the password security level</strong></p>
<ol class="ol" id="topic_tcn_ppr_2j__ol_xmp_3qw_jzb">
<li class="li" dir="ltr">Open the password security settings for team members
or end users. <ul class="ul" id="topic_tcn_ppr_2j__ul_jmf_yyw_gkc">
<li class="li"><span class="ph">In <a class="xref" href="https://support.zendesk.com/hc/en-us/articles/4581766374554#topic_hfg_dyz_1hb" target="_blank">Admin Center</a>, click <img class="image" id="topic_tcn_ppr_2j__d8e293" src="https://zen-marketing-documentation.s3.amazonaws.com/docs/en/ac_account_icon.png">
<strong class="ph b">Account</strong> in the sidebar, then select <strong class="ph b">Security &gt; Team member
authentication</strong>.</span></li>
<li class="li"><span class="ph">In <a class="xref" href="https://support.zendesk.com/hc/en-us/articles/4581766374554#topic_hfg_dyz_1hb" target="_blank">Admin Center</a>, click <img class="image" id="topic_tcn_ppr_2j__d8e308" src="https://zen-marketing-documentation.s3.amazonaws.com/docs/en/ac_account_icon.png">
<strong class="ph b">Account</strong> in the sidebar, then select <strong class="ph b">Security &gt; End user
authentication</strong>.</span></li>
</ul>
</li>
<li class="li">Select a <strong class="ph b">Password level</strong>, then click <strong class="ph b">Save</strong>.</li>
</ol>
</div>
</div>
<script id="docs-schema-markup" type="application/ld+json">{
"@context": "https://schema.org",
"@type": "TechArticle",
"@id": "https://support.zendesk.com/hc/en-us/articles/4408822149018",
"url": "https://support.zendesk.com/hc/en-us/articles/4408822149018",
"headline": "Setting the password security level",
"description": "You can set a password security level for team members or end users, create a custom policy for team members, and change the level so passwords meet the chosen requirements.",
"articleSection": "User sign-in",
"datePublished": "2021-10-16T03:33:33+00:00",
"dateModified": "2026-08-19T15:10:36.213193+00:00",
"inLanguage": "en",
"mainEntityOfPage": {
"@type": "WebPage",
"@id": "https://support.zendesk.com/hc/en-us/articles/4408822149018"
},
"author": {
"@type": "Organization",
"name": "Zendesk",
"@id": "https://www.zendesk.com"
},
"publisher": {
"@type": "Organization",
"name": "Zendesk",
"@id": "https://www.zendesk.com"
},
"isPartOf": {
"@type": "WebSite",
"name": "Zendesk Help",
"@id": "https://support.zendesk.com/hc/"
},
"about": {
"@type": "SoftwareApplication",
"name": "Zendesk",
"@id": "https://www.zendesk.com",
"softwareAddOn": {
"@type": "SoftwareApplication",
"name": "People and access",
"@id": "https://support.zendesk.com/hc/en-us/sections/5283086413338"
}
}
}</script><script id="fast-path-script">
//<![CDATA[
const fast_path_style = document.createElement('style');
fast_path_style.innerHTML = `#article-body .fastpath{font-size:.9em;background-color:#f3f3f3;border:1px solid #d3d3d3;padding:10px 10px 8px;margin-bottom:16px}#article-body .fastpath::before{content:none!important}`;
document.head.appendChild(fast_path_style);
//]]>
</script><script id="ai-summary-script">
//<![CDATA[
const ai_summary_style = document.createElement('style');
ai_summary_style.innerHTML = `#styled-article-body{padding:0 0 0}#article-body #docs-ai-summary{background-color:#f3f3f3;border:1px solid #d3d3d3;padding:10px 10px 6px;margin-bottom:16px}#article-body #docs-ai-summary #docs-ai-summary-toggle{font-size:.9em;font-weight:700;margin-bottom:4px;cursor:pointer;display:flex;justify-content:space-between;align-items:center}#article-body #docs-ai-summary #docs-ai-summary-toggle #up-triangle{margin-left:auto;padding-right:10px;display:none}#article-body #docs-ai-summary #docs-ai-summary-toggle #down-triangle{margin-left:auto;padding-right:10px}#article-body #docs-ai-summary #docs-ai-summary-content{font-size:.9em;padding-left:25px;padding-right:25px;margin-bottom:12px}`;
document.head.appendChild(ai_summary_style);

const toggleAISummary = () => {
const summary = document.getElementById("docs-ai-summary-content");
const upTriangle = document.getElementById("up-triangle");
const downTriangle = document.getElementById("down-triangle");
if (summary.style.display === "none") {
summary.style.display = "block";
upTriangle.style.display = "none";
downTriangle.style.display = "inline";
} else {
summary.style.display = "none";
upTriangle.style.display = "inline";
downTriangle.style.display = "none";
}
};

document.getElementById("docs-ai-summary-toggle").addEventListener("click", toggleAISummary);
//]]>
</script>
</body>