Family password rules
Set a floor under what your family's password generator produces — minimum length and required character types — and see where weak passwords remain.
Password rules in Family settings set the minimum your family's password generator will produce. Turn them on and everyone in the family — including you — generates passwords at or above that standard.
They shape the generator. They do not validate a password someone types by hand, and they do not change anyone's account sign-in password. A weak hand-typed password shows up in the Family Security Center rather than being blocked.
That boundary is deliberate, and worth understanding before you turn the rules on.
Turn the rules on#
- Open Family settings → Password Rules.
- Switch on Use family password rules. The rules below become editable.
- Set a minimum length and choose which character types are required.
- Select Save rules.
While the switch is off, every family member picks their own generator settings freely.
The rules#
| Setting | What it does |
|---|---|
| Minimum length | The shortest password the generator will produce. Between 8 and 128 characters. |
| Require an uppercase letter | Generated passwords include A–Z |
| Require a number | Generated passwords include digits |
| Require a symbol | Generated passwords include special characters |
Once saved, each family member's generator opens at or above these minimums and the matching controls are locked, with the reason shown. Trying to save generator settings below the family minimum is rejected with a message naming your family as the source.
Minimum length 16 with a number and a symbol required is strong enough for almost every account and short enough that nobody fights it. Long beats complicated: length contributes far more to a password's strength than exotic characters do.
What these rules deliberately don't do#
- They never reject a typed password. Checking a password's contents would have to happen on the device, because your family's passwords are encrypted with keys the service never holds (zero-knowledge model). A check that runs on the device can be worked around, and a rule that looks enforced but isn't is worse than no rule. Weak passwords are reported instead of blocked.
- They never touch account sign-in passwords. A family organizer cannot set requirements on how a family member signs in to their own account, and cannot lock anyone out of it.
- They don't change passwords already saved. Existing entries stay as they are. Use the Family Security Center to find the ones worth replacing.
- They don't reveal anything. Rules are about how passwords are created, never about what you can see. Family members' vaults stay encrypted to them alone.
Related#
- Family Security Center — where weak, reused and breached passwords in your family show up
- Shared family vault — choosing shared vaults and granting access
- Password generator — how members generate passwords