How to Configure Password Length-Based 2FA for Secure Login

Overview

With the Password Length Based Restriction feature, admins can make sure anyone using a weak, too-short password has to use Two-Factor Authentication (2FA). Once you turn this on, the system checks your password length every time you log in. If your password doesn't meet the minimum length, you’ll need to pass 2FA before you can get into your account. The Drupal Two Factor Authentication - 2FA / Passwordless Login is available for Drupal 8, Drupal 9, Drupal 10, and Drupal 11.

Download Pricing Plans Schedule a Meeting

Installation Steps

Post-Installation Prerequisites:

• Before configuring Password Length-Based Restriction, ensure that:
  • You have Administrator access to configure 2FA policies.
  • The Allow Passwordless Login option is disabled, as password length checks require password-based authentication.

Configuration Steps

Open 2FA Policy Settings

• Log in to your Drupal site as an Administrator.
• Navigate to the 2FA Policy for End Users tab.
• Scroll down to the 2FA Restrictions section.
• Select Password Length Based Restriction from the left-side menu.

Enable Password Length-Based 2FA

• Enable the Enable Password length restriction toggle.
• Once enabled, the system will start evaluating the password length of users during login.
• In the Enter the minimum password length field, specify the required password length.
• Example: 6 characters.
• Users with passwords shorter than 6 characters will be required to complete Two-Factor Authentication during login.
• Users with passwords 6 characters or longer will not be affected by this rule.
• Administrators can configure the minimum length based on their organization’s security requirements.
• Click the Save Settings button.
• A confirmation message will appear at the top of the page indicating the settings have been saved successfully.

You have successfully configured Password Length Based Restriction.

User Experience:

• Open a new browser/private window and navigate to your Drupal site login page.
• Enter your login credentials.
• The system evaluates the length of the user’s password based on the configured policy.
• If the password length is below the configured threshold, the user will be required to set up 2FA if not already configured. If configured, the user must complete 2FA authentication.
• If the password meets or exceeds the configured length requirement, 2FA will not be enforced for the user.