Password Strength Policy

Apr 28, 2026

New Password Strength Policy

Overview

We are rolling out a new Password Strength Policy to ensure all accounts are protected by appropriately strong passwords.

If your school authenticates using SSO/SAML2 or LDAP, this policy does not apply to you. You can safely skip this article.

For schools using username and password authentication, please read on.

Rollout Timeline

Date Who is affected
Now (immediately) SOBS Administrators — must have a Strong password
9th May 2026 All other staff and guests — must have at least a Poor password

What Are the Password Strength Levels?

Password strength is measured using zxcvbn, an open-source algorithm developed by Dropbox. Unlike traditional meters that simply check for uppercase letters, numbers, and symbols, zxcvbn analyses realistic attack patterns — dictionary words, keyboard sequences (like qwerty), repeated characters, dates, and common substitutions (like p@ssw0rd).

This means a long, memorable passphrase like correct-horse-battery-staple can score higher than a short, complex-looking password like P@ss1! — because it’s genuinely harder to crack.

The strength levels used in SOBS are:

  • Unacceptable — Trivially guessable passwords (e.g. password, 123456)
  • Poor — Weak, but not immediately obvious
  • Weak — Reasonably resistant to casual attacks
  • Medium — Robust against most attack scenarios
  • Strong — Highly resistant to sophisticated attacks

You can read more about how the zxcvbn algorithm works on the Dropbox Tech Blog.

Default Settings

We have implemented sensible defaults, but your school can adjust these:

  • SOBS Administrators — must have at least a Strong password (enforced immediately)
  • All other staff and guests — must have at least a Poor password (enforced from 9th May 2026)

We deliberately avoided forcing an overly prescriptive policy, but we do want to prevent passwords like password from being used.

Configuring Your School’s Password Policy

SOBS Administrators can raise (or lower) the minimum required password strength for your school’s staff.

To configure this:

  1. Go to the School Configuration page
  2. Select Authentication from the top-left menu
  3. Adjust the minimum acceptable password strength to suit your school’s policy

What Happens If a Password Doesn’t Meet the Standard?

If a user’s existing password falls below the required strength, they will be prompted to set a new password immediately after logging in. The system will guide them through choosing a password that meets your school’s configured minimum.

Administrator Notes

Setting Temporary Passwords

You can still set a temporary password on a staff member’s account, even if it is a weak one. However, the staff member will be required to choose a new, policy-compliant password the next time they log in.

Resetting All User Passwords

You can still perform a bulk password reset for all users. However, rather than specifying a password manually, the system will:

  1. Generate a random password for each staff member
  2. Send each staff member a login link via email

When a staff member clicks their login link, they will be prompted to set a new password that meets your school’s configured strength policy.

Summary

  • SSO/SAML2 or LDAP users: Not affected
  • SOBS Administrators: Must have a Strong password — effective immediately
  • All other staff and guests: Must have at least a Poor password — effective 9th May 2026
  • Only affects users whose current password is below the required strength
  • School Administrators can configure the minimum strength via School Configuration → Authentication