# auth0-password-policies

> Password policies presets used by Auth0. Extracted from [password-sheriff](https://github.com/auth0/password-sheriff).

Latest version **3.1.1** (published 2026-09-09) · MIT license · 0 weekly downloads

## Install

```sh
npm install auth0-password-policies
pnpm add auth0-password-policies
yarn add auth0-password-policies
bun add auth0-password-policies
```

## Health

**Score 60/100 (C)** — status: active.

Positive: no vulnerabilities; has provenance; recently updated; high maintenance score.

Warnings: low downloads; no types; no esm support.

## Facts

| | |
|---|---|
| Version | 3.1.1 |
| Published | 2026-09-09 |
| First published | 2018-09-27 |
| Weekly downloads | 0 |
| License | MIT |
| TypeScript types | none |
| Module format | CommonJS |
| Dependencies | 1 |
| Unpacked size | 25.7 KB |
| Known vulnerabilities | 0 |
| Install scripts | no |
| Provenance | attested (GitHub Actions) |
| GitHub stars | 6 |
| Author | Shaun Starsprung |
| Maintainers | auth0npm |

## Links

- npm: https://www.npmjs.com/package/auth0-password-policies
- Repository: https://github.com/auth0/auth0-password-policies
- Homepage: https://github.com/auth0/auth0-password-policies#readme
- Issues: https://github.com/auth0/auth0-password-policies/issues
- npm.io page: https://npm.io/package/auth0-password-policies

## Dependencies (1)

- [password-sheriff](https://npm.io/package/password-sheriff.md) ^2.0.0

## Recent versions

- 3.1.1 (latest) — 2026-09-09
- 3.2.0-beta-test.2 (beta-test) — 2026-07-02
- 1.1.0 (beta) — 2025-08-26
- 3.1.0 — 2026-02-17
- 3.0.0 — 2026-01-08
- 2.2.0 — 2025-12-03
- 2.1.0 — 2025-11-10
- 2.0.0 — 2025-09-16
- 1.1.1 — 2025-08-26
- 1.0.2 — 2018-11-06
- 1.0.1 — 2018-09-27

## README

# auth0-password-policies

Password policies presets used by Auth0. Extracted from [password-sheriff](https://github.com/auth0/password-sheriff).


## Policies

### none
* minimum characters: 1

### low
* minimum characters: 6

### fair
* minimum characters: 8
* contains at least one character in each group: lowerCase, upperCase and numbers

### good
* minimum characters: 8
* contains at least one character in three different groups out of: lowerCase, upperCase, numbers, specialCharacters

### excellent
* minimum characters: 10 
* contains at least one character in three different groups out of: lowerCase, upperCase, numbers, specialCharacters
* may not contain any character repeated more than twice

## Helpers

### createRulesFromOptions
Converts an Auth0 `connection.options.password_options.complexity` object into a `password-sheriff` compatible rules object, and applies default values.

Usage:
```js
const { PasswordPolicy } = require('password-sheriff');
const { createRulesFromOptions } = require('auth0-password-policies');

const passwordOptions = {
  character_types: ["uppercase","lowercase","number","special"],
  character_type_rule: "three_of_four",
  identical_characters: "block",
  sequential_characters: "block",
  max_length_exceeded: "error"
};

const rules = createRulesFromOptions(passwordOptions);
const customPolicy = new PasswordPolicy(rules);
console.log(customPolicy.toString());
/**
* Output is:
* * At least 15 characters in length
* * At least 3 of the following 4 types of characters:
*   * lower case letters (a-z)
*   * upper case letters (A-Z)
*   * numbers (i.e. 0-9)
*   * special characters (e.g. !@#$%^&*)
* * No more than 2 identical characters in a row (e.g., "aaa" not allowed)
* * No more than 2 sequential alphanumeric characters (e.g., "abc" not allowed)
* * Maximum password length exceeded
*/
```

## Publishing

Releases are fully automated via [semantic-release](https://semantic-release.gitbook.io/). Merging to `master` triggers a release if any qualifying commits are present — no manual tagging or version bumps required.

### Commit message format

Commits must follow [Conventional Commits](https://www.conventionalcommits.org/):

| Commit prefix | Release type |
|---|---|
| `fix:` | Patch (`1.0.0` → `1.0.1`) |
| `feat:` | Minor (`1.0.0` → `1.1.0`) |
| `BREAKING CHANGE:` footer | Major (`1.0.0` → `2.0.0`) |
| `chore:`, `docs:`, `test:`, etc. | No release |

### What happens on merge to master

1. Tests run across Node.js 16, 18, and 20
2. semantic-release analyzes commits since the last release
3. If a release is warranted: creates a GitHub Release, pushes a `v*` tag, and publishes to npm with provenance

---
_Source: https://npm.io/package/auth0-password-policies · Machine-readable twin of the npm.io package page. Health data is recomputed on every publish._