> On Oct 26, 2026, at 09:43, Mohammad Abu Ata <[email protected]>
> wrote:
>
> We are evaluating PostgreSQL 17 for enterprise use. Could you please confirm
> whether PostgreSQL provides built-in password policy enforcement without
> third-party extensions?
The question is a bit more nuanced than "yes" or "no." `passwordcheck`
provides basic password complexity checking, but does not provide the other
aspects of policy enforcement you are looking for.
As the `passwordcheck` documentation notes, password complexity checking within
PostgreSQL's core server is difficult to provide for authentication methods
where the password is stored in the database itself, as the client has the
option to send over a pre-hashed password.
Again, as the `passwordcheck` documentation notes, if you have security
requirements of the type you describe, it's better to use an external password
management system such as GSSAPI, rather than store passwords direclty in the
database. This also meets a very common requirement for immediate blanket
revocation of authorization for a terminated user, rather than having to
disable accounts piecemeal across the environment.
PostgreSQL does provide a wide range of authentication mechanisms directly in
the core distribution; you can see the full list at:
https://www.postgresql.org/docs/current/client-authentication.html
Best,
-- Christophe
