> ## Documentation Index
> Fetch the complete documentation index at: https://ayakaleaf-pro.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Password restrictions

> Set the minimum and maximum length of local passwords on a Kubernetes deployment.

The **web** service checks local passwords when users register, set or change a password. SSO logins (LDAP, SAML, OIDC) are not affected; their passwords are the identity provider's business. See [Password restrictions](https://ayakaleaf-pro.mintlify.site/on-premises/configuration/overleaf-toolkit/authentication/password-restrictions.md) for the Toolkit.

| | |
| - | - |
| Service | web, in every Ayakaleaf Pro pod; read when web starts |
| Network | none |
| Periodic jobs | none |

### Configuration

Add to the ConfigMap `overleaf-env` and restart:

```yaml title="30-config.yaml (additions)" theme={null}
  OVERLEAF_PASSWORD_VALIDATION_MIN_LENGTH: "12"
  OVERLEAF_PASSWORD_VALIDATION_MAX_LENGTH: "72"
```

```bash theme={null}
kubectl apply -f 30-config.yaml
kubectl -n overleaf rollout restart deployment/overleaf     # or statefulset/overleaf
```

| Variable | Default | |
| - | - | - |
| `OVERLEAF_PASSWORD_VALIDATION_MIN_LENGTH` | `8` | Shortest password accepted. |
| `OVERLEAF_PASSWORD_VALIDATION_MAX_LENGTH` | `72` | Longest password accepted; values above `72` are treated as `72`. |

Quote the numbers: a ConfigMap only holds strings.

> [!WARNING]
>
> `OVERLEAF_PASSWORD_VALIDATION_PATTERN` is read but not enforced: a password that does not match it is accepted. Only the length limits apply.

### Several replicas

Nothing extra: every replica reads the same ConfigMap.

### Tested on Kubernetes

On Kubernetes 1.37 with one replica, `OVERLEAF_PASSWORD_VALIDATION_MIN_LENGTH: "12"` and `OVERLEAF_PASSWORD_VALIDATION_PATTERN: aA$3` in the ConfigMap, activating a new account refused a 10-character password and accepted a 20-character password of lowercase letters only, which the pattern would have refused. Our end-to-end tests for registration also refuse `123456` as too short with the defaults.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.