Indeed modified its password security requirements for user accounts in an update detected on August 13, 2026. The previous requirement specified a minimum of 10 characters and separately stated password history of 12; the updated terms now require a minimum length of 14 characters, a password history of 12 (preventing reuse of the previous 12 passwords), and a minimum password age of one hour. Additionally, the updated terms add a new restriction that passwords must not be a derivative of the user's ID or name. The practical effect is stricter password creation standards and a mandatory one-hour wait period before changing a password again.
low severity
0Sentences added
0Sentences removed
3Sentences modified
1802Sentences before
1802Sentences after
Added
Removed
Modified
Before
After
1766
Users are required to follow secure practices in the use of authentication information including password configurations providing for a minimum length of 10 characters.
1766
Users are required to follow secure practices in the use of authentication information.
1767
Password history of 12.
1767
Password configurations for user accounts must provide for a minimum length of 14 characters, a password history of 12 (meaning the previous 12 passwords cannot be reused), and a minimum password age of one hour.
1768
Complexity requiring 3 out of the following 4 character types: Capital Letters, Lowercase Letters, Numbers, Special Characters.
1768
Additionally, passwords must not be a derivative of the user’s ID or name.
Stay ahead of the changes
Watch this before it changes again
Follow unlimited companies, monitor the clauses that matter across every platform, and get the full institutional analysis on what each change obligates you to do.