CouchDB Password Complexity

[OzzyAndMazel2022]

Are there any plans to introduce password complexity requirements into CouchDB? I have a product in my portfolio that is trying to satisfy the the following requirements:

Rule 1). minimum of 15 characters, including at least one of each of the following character sets:

• Uppercase.
• Lowercase.
• Numerics.
• Special characters (e.g., ~ ! @ # $ % ^ & * ( ) _ + = - ' [ ] / ? > <).

Rule 2). Minimum number of characters changed from previous password: 50 percent of the minimum password length; that is, eight.

• Password lifetime limits for interactive accounts: Minimum 24 hours, maximum 60 days.
• Password lifetime limits for noninteractive accounts: Minimum 24 hours, maximum 365 days.
• Number of password changes before an old one may be reused: Minimum of five.

[rnewson]

There are no plans to add any of these features. You can use other authentication handlers (like proxy or JWT) instead and then move your password management external to CouchDB?

Some of your suggestions represent outdated security practices (forced expiration, "special" characters) and we would not adopt them in 2026.

We would consider a pull request that introduced the things that NIST currently recommend, which is essentially just a minimum length of password.

I also note it is possible to add MFA (https://docs.couchdb.org/en/stable/api/server/authn.html#logging-in-with-2fa)

[rnewson]

I missed this: https://docs.couchdb.org/en/stable/config/auth.html#chttpd_auth/password_regexp