Guide
PCI DSS password requirements, explained for version 4.0
PCI DSS password requirements changed with version 4.0, and the longer minimum length became mandatory in 2025. So many merchants now need to update both settings and policy.
- We prepare, a QSA assesses
- Published price ranges
- Written estimate, no call
The core PCI DSS password requirements
Requirement 8 governs user identification and authentication. The main password rules are short. However, each one needs evidence, not just a policy line.
| Rule | Version 4.0 expectation |
|---|---|
| Minimum length | At least 12 characters, or 8 where a system cannot support 12. |
| Complexity | Both numbers and letters. |
| History | Not the same as any of the last four passwords. |
| Lockout | After no more than 10 failed attempts, for at least 30 minutes. |
| Change | Every 90 days when the password is the only factor, unless access is analysed dynamically. |
How MFA changes PCI DSS password requirements
Multi-factor authentication is required for all access into the cardholder data environment. Also, administrative access needs it. So passwords become one factor among several, rather than the whole defence.
PCI DSS password requirements self-check
Tick what you can prove today. Unticked items are where findings usually appear.
Your result appears here as you tick, so you can see what is still open.
Where PCI DSS password requirements often fail
Most findings come from forgotten systems. For example, a network device keeps an old length setting, or a service account never changes.
- Default vendor passwords left on devices
- Shared accounts without individual accountability
- Service accounts excluded from review
- Policies that say 12 characters while systems allow 8
Evidence a QSA samples
Assessors usually compare policy with configuration. Therefore keep screenshots or exports of password settings, plus records of account reviews. Also note any system that cannot support 12 characters, because that exception needs a reason.
Where we help
We are not a QSA, so we do not decide whether you comply. Instead, we check settings against policy and fix the gaps before your assessment. Policy and documentation work runs $10,000 to $30,000. The standard itself is in the PCI SSC document library.
PCI DSS password requirements questions
When did the 12-character PCI DSS password requirements apply?
The longer minimum became mandatory on 31 March 2025, after the transition period for version 4.0.
Do PCI DSS password requirements apply to customers?
Customer passwords are treated differently. The 90-day change rule, for example, does not apply to customer accounts.
Are passphrases acceptable under PCI DSS password requirements?
Yes, if they meet the length and complexity rules.
Does MFA remove the need for strong passwords?
No. Each factor must still meet its own rules.
Related guides
Close your PCI DSS password requirements gaps
Tell us how many systems touch card data. We reply with a written estimate, usually inside one business day.
Get my written estimate