Staff Password Requirements

Print Friendly and PDF Follow

Default Password Requirement

The default validation rule for passwords now requires at least eight characters with at least one lowercase letter, one uppercase letter, and one number, and is expressed by this regular expression:


With the Aeon default password requirement, passwords must contain:

  • At least 8 characters
  • At least 1 lowercase letter
  • At least 1 uppercase letter
  • At least 1 number

Setting the Password Requirement

To set the default validation rule for Aeon passwords:

  1. Open the Aeon Customization Manager.
  2. Navigate to Web Interface | Validation | WebValidation.
  3. In the Validation field, change the value to ^(?=.*\d)(?=.*[a-z])(?=.*[A-Z]).{8,}$
  4. Click Save.

Editing the Password Requirement

The default password requirement can be edited to fit specific institution needs. This is done by simply editing the regular expression that sets the password requirement.

See Testing Regular Expressions for more information about regular expressions.

  1. Navigate to Web Interface | Validation | WebValidation in the Aeon Customization Manager.
  2. Double-click on the line you want to edit (Change Password or Registration).
  3. Edit the Validation field.
  4. Click Save.

Password Examples

The default requirement above (^(?=.*\d)(?=.*[a-z])(?=.*[A-Z]).{8,}$) breaks down roughly as:

  • A ^ and $ character to indicate the beginning and end of the text.
  • A series of (?=.*#character class#) elements, which look ahead to make sure at least some part of the text matches the given #character class#, which includes
    • \d - any number
    • [a-z]any lowercase number
    • [A-Z]any uppercase number
  • .{8,} to ensure the text is at least eight characters.

Here are some examples of some common complexity requirements expressed as regular expressions. Remember that the web validation fields cannot exceed 255 characters when designing your regular expressions, and to change the rule for both the registration and the change password forms.

Require at least eight characters with at least one letter, one number, and one symbol
Require between 8 and 20 characters with at least one letter and one number
Require at least 10 characters
Requires a password of at least eight characters with characters coming from at least two of the following three groups: letters, numbers, and symbols.

Unique Password Requirements

As of Aeon 4.2, Staff passwords will check the new password using a configurable number (default value: 4) of previous passwords for uniqueness when a staff user is changing his/her password. This will prevent staff users from reusing a previous password or rotating through similar passwords. 

The default can be changed in the Customization Manager by changing the default value of the StaffPreviousPasswordCount key.

  • If the value is set to 4, then the user must have 4 unique passwords before an old password can be reused.
  • If the value is set to 0, the password will not be checked against the user's password history when updating the password.

Encryption for Stored Passwords 

As of Aeon 4.2, staff password as stored with enhanced encryption methods using the Password-Based Key Derivation Function 2 (PBKDF2) hashing strategies. The iterations (default value: 156,000) store the hashed passwords as an algorithm. When a user logs in with a password, it will be compared with the hash algorithm to verify the password is correct before permitting clearance into Aeon.

The default value can be changed in the Customization Manager by change the value of the StaffPasswordHashingIterations key. If you wish to change the default iterations, it's highly recommended to contact support for the number of iterations that work best for the speed of your computer and the hash algorithm. Generally, hash iterations should not be set to less than 100,000. 


If this article didn’t resolve your issue, please take a moment and answer a few questions to help improve our documentation: