Mohammad, Please find below
PostgreSQL 17 does not provide comprehensive, built-in enterprise password
policy enforcement out of the box. Core PostgreSQL deliberately delegates
advanced identity and credential lifecycle management to external identity
providers or specialized extensions.
Password Complexity & Min Length - Partial / Minimal - Not natively
configurable in core SQL syntax. Without modules, passwords of any length or
composition are accepted.
Password Expiration - Partial - Supported via the VALID UNTIL 'timestamp'
clause during CREATE ROLE or ALTER ROLE. However, there is no automatic
expiration interval
(e.g., forcing a rotation every 90 days); administrators must explicitly set a
static date for each role.
Password History & Reuse Prevention - No - Core PostgreSQL does not store
previous password hashes or maintain password history. A user can cycle back to
an old password immediately.
Account Lockout on Failed LoginsNoFailed authentication attempts do not trigger
an automatic account lockout.
Capabilities and Limitations of passwordcheck
The passwordcheck module is a sample contrib library included with PostgreSQL
distributions that hooks into check_password_hook.
*
Enforces basic complexity: requires passwords to contain a mix of letters and
non-letters and rejects passwords identical to the username or reversed
username.
*
In PostgreSQL 17, it enforces a hard-coded minimum length of 8 characters (the
configurable passwordcheck.min_password_length parameter was introduced in
PostgreSQL 18).
*
Can optionally link to CrackLib, but this requires rebuilding the module from
source due to licensing.
*
It does not manage password expiration intervals, enforce password rotation
policies, maintain password history, or prevent password reuse.
*
It has no awareness of authentication events, meaning it cannot track failed
logins or perform account lockouts.
*
It only evaluates passwords sent in clear text during CREATE ROLE or ALTER ROLE
statements; pre-hashed passwords (such as SCRAM-SHA-256 strings generated by
client tools) bypass passwordcheck completely.
PostgreSQL Extensions
If you must enforce policies within local database accounts, you will need
third-party extensions:
*
credcheck / password_profile: Specialized extensions that implement password
history tracking, reuse blocking, minimum change intervals, and automatic
failed-attempt lockouts via PostgreSQL's internal C hooks (check_password_hook
and ClientAuthentication_hook).
*
auth_delay (Bundled Contrib): Adds a configurable millisecond delay (e.g.,
500ms–2000ms) on failed logins to slow down brute-force attacks, though it does
not lock the account.
Regards
Yuvaraj Ganapathy
+1 214-460-3006 (Mobile)
________________________________
From: Mohammad Abu Ata <[email protected]>
Sent: Monday, October 26, 2026 05:43
To: [email protected] <[email protected]>
Cc: Abdelrahman Mansour <[email protected]>; Ahmad Y Al Kandari
<[email protected]>; Mahmoud Al-Muhtaseb <[email protected]>
Subject: PostgreSQL 17 — Native Password Policy Support
Hello PostgreSQL Community,
We are evaluating PostgreSQL 17 for enterprise use. Could you please confirm
whether PostgreSQL provides built-in password policy enforcement without
third-party extensions?
Specifically, we need to know whether PostgreSQL natively supports:
- Password complexity and minimum length
- Password expiration
- Password history and prevention of password reuse
- Account lockout after repeated failed login attempts
We are aware of the `passwordcheck` module. Does it provide these capabilities,
or are additional extensions or external authentication systems required?
Thank you for your clarification.
Best Regards,
Mohammad Abuata
Senior Software Engineer
[Logo]<https://urldefense.com/v3/__https://www.leading-point.com/__;!!GiDqg7uCaixV!ShbeL6Ho5P9W8jo2ueG-2mCc9iVLOUp8M1Ljk2qqGFmjUnl8fcND7MK63ASYPFvT1h2TQhbO-5z_RWQ0v2jVFokgAwd2$>
Leading Point Software
90, Wasfi At-Tall Street, Amman
T: +96265604808<tel:+96265604808>
M: +962797639855<tel:+962797639855>
M: +96879101447<tel:+962797639855>
www.leading-point.com<https://urldefense.com/v3/__http://www.leading-point.com/__;!!GiDqg7uCaixV!ShbeL6Ho5P9W8jo2ueG-2mCc9iVLOUp8M1Ljk2qqGFmjUnl8fcND7MK63ASYPFvT1h2TQhbO-5z_RWQ0v2jVFk7Z4NES$>
[Facebook
icon]<https://urldefense.com/v3/__https://www.facebook.com/LeadingPoint/__;!!GiDqg7uCaixV!ShbeL6Ho5P9W8jo2ueG-2mCc9iVLOUp8M1Ljk2qqGFmjUnl8fcND7MK63ASYPFvT1h2TQhbO-5z_RWQ0v2jVFj2DmDH1$>
[LinkedIn icon]
<https://urldefense.com/v3/__https://www.linkedin.com/company/leading-point/__;!!GiDqg7uCaixV!ShbeL6Ho5P9W8jo2ueG-2mCc9iVLOUp8M1Ljk2qqGFmjUnl8fcND7MK63ASYPFvT1h2TQhbO-5z_RWQ0v2jVFhbqOIfe$>
[Twitter icon]
<https://urldefense.com/v3/__https://twitter.com/leadingpointcom__;!!GiDqg7uCaixV!ShbeL6Ho5P9W8jo2ueG-2mCc9iVLOUp8M1Ljk2qqGFmjUnl8fcND7MK63ASYPFvT1h2TQhbO-5z_RWQ0v2jVFp8bMaYA$>
[instagram icon]
<https://urldefense.com/v3/__https://www.instagram.com/leadingpoint/__;!!GiDqg7uCaixV!ShbeL6Ho5P9W8jo2ueG-2mCc9iVLOUp8M1Ljk2qqGFmjUnl8fcND7MK63ASYPFvT1h2TQhbO-5z_RWQ0v2jVFmdXbKFt$>
[Banner]<https://urldefense.com/v3/__https://www.leading-point.com/__;!!GiDqg7uCaixV!ShbeL6Ho5P9W8jo2ueG-2mCc9iVLOUp8M1Ljk2qqGFmjUnl8fcND7MK63ASYPFvT1h2TQhbO-5z_RWQ0v2jVFokgAwd2$>
