Password restrictions

It is possible to enforce password restrictions on user accounts when using the native Overleaf login system for authentication.

It is not possible to enforce password restrictions for SSO (LDAP/SAML 2.0) logins. These must be configured in your Identity Provider (IdP).

To enable password restrictions, set the relevant environment variables in the Toolkits config/variables.env file.

Name	Description	Default
`OVERLEAF_PASSWORD_VALIDATION_MIN_LENGTH`	The minimum length required.	`8`
`OVERLEAF_PASSWORD_VALIDATION_MAX_LENGTH`	The maximum length allowed.	`72`
`OVERLEAF_PASSWORD_VALIDATION_PATTERN`	Used to validate password strength: `abc123` – password requires 3 letters and 3 numbers and be at least 6 characters long `aA` – password requires lower and uppercase letters and be 2 characters long `ab$3` – it must contain letters, digits and symbols and be 4 characters long There are 4 groups of characters: letters, UPPERcase letters, digits, symbols. Everything that is neither letter, nor digit is considered to be a symbol.	—

Last modified on October 4, 2026