The password quality scale

When creating passwords for user, server, or certifier IDs, you need to understand the criteria by which Domino® measures password strength and security. Domino measures this criteria according to the level assigned on its password quality scale. The scale assigns a minimum level of quality to the password on an ID file. Domino bases the password quality on the number and variety of characters in the password.

The algorithm used to calculate password quality is used to enforce the selection of passwords that are sufficiently complex to meet the password quality scale level chosen to protect user ID files. When a user is registered, the user's ID file contains a password strength value. This setting is enforced if the user changes the password.

The scale ranges from 0 (weakest -- no password required) to 16 (strongest). A quality of 1 indicates that any password satisfies the criteria. Domino defines default levels for certifier, server, and user password quality. You should change these defaults to meet your organization's security criteria. You can set the defaults in a security settings policy document, in Administration Preferences, or in the registration or certification dialog boxes.

Password strength is not the same as password length. Not all passwords of equal length have equal strength in the password quality scale. For example, the 8-character word "password" (because it is a word) and the 8-character word "1168Acme" (because it contains numbers and alphabetic characters) do not carry the same level of character complexity and do not have equal strength on the quality scale.

Table 1. Password quality scale descriptions
Password quality scale Description Example
0<nozeros>Password is optional.None.
1<nozeros>Allow any password.b, 3
2-6Allow a weak password, even though you might be able to guess it by trial and error.password, doughnut (password quality scale 3)

lightferret, b 4D (password quality scale 6)

7-12Require a password that is difficult to guess, but might be vulnerable to an automated attack.pqlrtmxr, wefourkings (password quality scale 8 )
13-16Require a strong password, even though the user may have difficulty remembering it.4891spyONu (password quality scale 13)

lakestreampondriverocean, stRem2pO() (password quality scale 15)

stream8pond1river7lake2ocean (password quality scale 16)

Tips for assigning passwords and scale

Understanding the algorithm

A password's strength is based on several factors. A password starts out with a rating equal to the length of the password. It receives a 25 percent bonus if it contains one of the following, and a 50 percent bonus if it contains two or more:

Digits in the last position and uppercase letters in the first position do not qualify as bonus characters because these are commonly used modifications to passwords to evade password-checking mechanisms.

In addition, the rating decreases if the password contains anything that can be programmatically determined to be predictable, for example, words in a dictionary or repeating characters.

Parent topic: Domino server and Notes user IDs

Related concepts
Password-protection for Notes and Domino IDs