Password rules, expiry and required changes

A team's owners and admins choose how strong its mailboxes' passwords must be, whether they expire, and can ask anyone (or everyone) to choose a new password the next time they sign in. Everything here is in the team manager (/manage) under Settings → Security, card Password rules, and in the Mailboxes list.

These rules are for mailbox passwords. If your mailboxes sign in with their Zappocity account (single sign-on), its own rules apply there instead, and nothing here holds them back. See One sign-in for everything.

The rules

Fewest characters: 12 to 128 (12 unless you change it).
Kinds of character required: any (length only), or 2, 3 or all 4 of lower case letters, upper case letters, digits, and other characters (punctuation, spaces, symbols).
Passwords expire after: never (0), or 7 to 3650 days.
Passwords remembered: 0 to 24. A user choosing a new password may not pick any of their last this many, the current one included. The current password is always refused, whatever this is.

The rules apply to every new password for the team's mailboxes, whoever chooses it: a user changing theirs in webmail, a reset link, the team's join page, and an administrator setting one in the team manager, the API or the command line. A password that falls short is refused with the rule it breaks. The Generate button always makes one that passes.

Passwords already set are not checked again (they are stored only as hashes, so nobody can). To apply new rules to everyone, use Require a new password from everyone after saving them.

Length matters far more than symbols: "correct horse battery staple" is much harder to guess than "P@ssw0rd!". Most guidance today (such as NIST SP 800-63B) advises a long minimum, no forced mix, and no regular expiry unless a password may have leaked. Turn on two-step sign-in for the strongest protection.

Expiry

With expiry on, each password lasts that many days from when it was last set, or from when expiry was turned on if that is later, so turning it on never shuts everyone out at once. Changing the number of days later applies to every password at once (counted the same way).

Webmail tells people in the last two weeks, once a day, when their password expires, and shows the date under Settings → Password. Once it has expired:

Signing in to webmail with it opens only a form to choose a new one.
Mail apps using it (IMAP, SMTP, ManageSieve, JMAP, CalDAV, CardDAV) are refused until it is changed. App passwords keep working.
The new password can't be the same as the old one.

Password history

When a mailbox's password changes, the old one is kept as a hash (never the password itself), up to the last 24 for each mailbox. With Passwords remembered set to, say, 5, a user changing their password in webmail or from a reset link can't choose their current one or any of the four before it. Raising the number later counts the passwords already kept, so it applies at once.

An administrator setting a password for someone (in the team manager, the API or the command line) is not held to the history, since they can't know it; ask the user to choose their own with Require new password. Removing a mailbox removes its history.

Requiring a new password

In the Mailboxes list, Require new password on a mailbox makes that person choose a new password at their next sign-in, keeping the password they have until then. Cancel password change takes it back. To ask everyone at once (after a suspected leak, or to apply new rules), use Require a new password from everyone on the Password rules card. You are left out, so you aren't locked out of the page you are using; change yours in webmail.

Until they choose a new one, it works like an expired password: webmail opens only the change form, mail apps using the password are refused, and app passwords keep working. Sessions already open are held back at once. Sessions you or support staff open as the user, to help them, are not.

Shared mailboxes and mailboxes that sign in only with Zappocity have no password of their own, so they are never asked.

The Password column shows must change, expired, or when the password was set and expires (hover over it).

From the API and the command line

Rules: PATCH /v1/tenants/{tenantId}/team-settings with passwordMinLength, passwordClasses, passwordMaxAgeDays and passwordHistory; corpsuite tenant team set acme passwordMinLength:=16 passwordClasses:=3 passwordHistory:=5.
One mailbox: PATCH /v1/tenants/{tenantId}/accounts/{accountId} with {"mustChangePassword": true} (or false); corpsuite mailbox password require amy@acme.com (or cancel).
Everyone, or a list: POST /v1/tenants/{tenantId}/accounts/password-change with {} or {"accounts": ["…"]}; corpsuite tenant password-change acme.

Only owners and admins choose the rules. Requiring new passwords needs the Users part of the team manager.