How to Determine the Minimum Password Length in Windows 10 and Why You Should Set it?

Microsoft’s suite of software and online services comes with a minimum password length requirement. Some even require the inclusion of special characters. Windows 10 has its own instructions, but they do not apply to local user accounts. Yes, you can create a local user account without a password. However, it is risky. Therefore, we recommend that you set the minimum password length for your user account on your Windows 10 computer.

Let’s first see how we can enforce the minimum password length requirement for local user accounts in Windows 10. Then we will understand why you should do it.

Let’s start.

Why Do You Need a Minimum Password Length for Local User Accounts?

The short answer is privacy and security. I’m sure you know this. Creating a local user account on the same computer allows you to access Windows offline without the need for a Microsoft account. Local user accounts are local and do not need an internet connection to allow access. This means that account settings will not sync across devices and everything will stay offline. Some users prefer this way. You can still sign in to Windows apps and services, but without using a Microsoft account in Windows 10.

By default, Microsoft did not add a minimum password length policy to local user accounts. You can turn this option on, but it is hidden deep in Registry Editor and Group Policy Editor.

Anyone with access to your computer can easily switch to this local user account and gain access to every nook and cranny of the hard disk. You don’t want this to happen. You may want to keep everything offline and not be tied to a Microsoft account for various reasons. But there are also offline threats. Whether you are at home, in the office or in the cafe, anyone can physically access your computer and wreak havoc on your life.

Using passwords solves this, but people often use stupid passwords. Some popular examples of ‘stupid password’ are date of birth, house or license plate numbers or even 1234. This is where password length can come in handy. It’s always better to force users to use a longer password. The FBI recommends that even with simple letters/numbers, longer passwords are better than short passwords with special characters.

The idea is simple but logical. A longer password offers more possible combinations, making it harder to crack but easier to remember. This is because cracking a longer password will take more computing power and therefore more time. And there is academic research to support this theory.

1. Set Minimum Password Length Using CMD

This method is for Windows 10 Home users. Search for and open Command Prompt (CMD) with administrative rights from the start menu.

Here is the command to increase the minimum password length requirement. Replace the text ‘PassLength’ below with the minimum number of characters you want to use in the new password and press Enter.

net accounts /minpwlen:PassLength

Do you want to check if the command is working? One way is to create a new local account and set a password with a shorter length than the set one. Another way is to issue the following command in CMD.

net accounts

You should see the minimum password length specified here, among other things. This much. A local account will now need a minimum length password.

Issue the following command to remove the minimum password length requirement.

net accounts /minpwlen:0

2. Set Minimum Password Length Using Group Policy Editor

This method is suitable for Windows Pro and Enterprise users with access to GPE or Group Policy Editor. GPE comes with a GUI or Graphical User Interface that lets you make system-level changes without having to fiddle with commands. However, caution is needed as things can go wrong.

I recommend taking a backup or creating a restore point before continuing. If you work in an organization and have an IT administrator, check with him for more details as domain policy will take precedence over your system policy.

To call gpedit.msc Open it in the Windows Start menu and open it.

Examine the folder structure below.

Computer Configuration\Windows Settings\Security Settings\Account policies\Password Policy

Note: If you enter the value as 0 (zero), it means no password is required for the local user account.

Enter the new value in characters for the minimum password length, click Apply and OK to save everything.

Want to have the best of both worlds? You can also force users to use special characters in their passwords. You can also force them to change their passwords every X days.

Double click to open ‘Password must meet complexity requirements policy’.

Select Enable and save everything. The criteria to be implemented through this policy are:

• The password length you specified in the step above. The default value is 6 characters long.
• It cannot contain the account name or full name of the user that exceeds two consecutive characters.
• Must contain at least one (1) character:
  • Capital letter (A to Z)
  • Lowercase (a to z)
  • Numbers (0 – 9)
  • special characters (!, @, #, $)

Double click to open Maximum password age policy file to force user to change password every X days.

Enter the number of days the user will be prompted to change the local user account password. These additional checks are there to increase security, but remembering new passwords can be a pain. It can be a bit too much, especially for older people who find it difficult to work with computers and remember passwords. Choose an appropriate number such as 45 days or 90 days.

Maximum Safety Precautions

Carefully set the minimum password length criteria. You may want to find a balance between convenience, usability, and security. A lot will depend on where you work, the technical skills of the users working on these computers, and how much you want to protect what’s on this HDD/SSD. If you share the computer with someone in your family, it can be a nuisance.

Fortunately, Microsoft has made things very flexible lately by giving administrators more control over how different aspects of local and online accounts are managed.

Next: Accidentally deleted an administrator account in Windows 10? Click the link below to learn how to recover deleted administrator account. Better yet, learn how to avoid this situation altogether.