---
title: "Password policy"
slug: "password-policy"
updated: 2026-05-15T11:05:34Z
published: 2026-05-15T11:05:34Z
canonical: "docs.smartly.io/password-policy"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.smartly.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Password policy

## Use a strong and unique password

A good password is easy to remember but hard for both humans and computers to guess. We recommend using a password or passphrase that you don't use anywhere else as your Smartly password. Besides the password, we strongly recommend using either [Single Sign-On (SSO)](/v1/docs/single-sign-on-sso) or setting up a [Multi-Factor Authentication](/v1/docs/enable-multi-factor-authentication-mfa) to login to the Smartly app.

We also recommend using a password manager to generate and manage your passwords, because they make using truly random and unique passwords easier for you.

To encourage the use of good passwords, we currently enforce the following rules [recommended by the NIST](https://pages.nist.gov/800-63-3/sp800-63b.html#memsecretver) (from NIST Special Publication 800-63B on Digital Identity Guidelines, Section 5.1.1.2) for passwords:

- Password **must** be at least 12 characters long
- Password **must not** have appeared in previous breach corpuses

## Checking if a password has been leaked in a data breach

When you sign up or change your password, we use the [PwnedPasswords API](https://haveibeenpwned.com/API/v3) to check if the new password is present in past data breach corpuses. **We’re not sending your** **password anywhere.** This is a proven, secure technique. For technical details, see the PwnedPasswords [API documentation](https://haveibeenpwned.com/API/v3) and [this blog post section](https://www.troyhunt.com/ive-just-launched-pwned-passwords-version-2/#cloudflareprivacyandkanonymity) from Troy Hunt, the author of the API.

We’re not checking if your current password is present in past data breaches. If you are not using a password manager that checks whether your passwords have appeared in data breaches, we recommend you check your current password [on the Pwned Passwords website](https://haveibeenpwned.com/Passwords).