Passwords
The rules a password must follow, and how Credential stores passwords.
Password rules
New passwords, at registration and with /changepassword, must follow the rules in scenario.registration.credential of providers/Credential/settings.yml:
scenario:
registration:
credential:
minLength: 6
maxLength: 32
minUpper: 1
minLower: 1
minNumber: 1
minSpecial: 1By default a password needs 6 to 32 characters, with at least one upper case letter, one lower case letter, one digit and one symbol. That is stricter than many players are used to; set a rule to 0 to stop enforcing it. Spaces are never allowed.
Typing the password twice
With requireRepeat: true, the default, a new player types their password with /pass, then again with /passconfirm. With false, the account is created after the first password.
changePassword.requireRepeat does the same for /changepassword <current> <new> [repeat]. With false, the repeat argument is optional, but a repeat that is given must still match. The command keeps offering [repeat] in its help until you also remove it from the change-password usage in providers/Credential/commands.yml; see usage.
Closing registration
scenario.registration.enabled: false stops new players from registering with Credential, and accounts from moving to it. Existing accounts keep logging in.
Hashing
Credential never stores a password, only a hash of it. cryptography.algorithm chooses how new hashes are made:
algorithm | Notes |
|---|---|
bcrypt (default) | widely used; reads only the first 72 bytes of a password, and a character outside ASCII takes two to four bytes |
argon2 | Argon2id; no length limit, uses more memory per login |
Every account remembers how its hash was made, so changing the algorithm does not lock anyone out. With autoupgrade: true, the default, a player's hash is remade with the configured algorithm the next time they log in successfully.
The cost settings, algorithms.bcrypt.cost and the algorithms.argon2 values, make each hash slower to compute, for logins and for anyone trying to guess passwords from a stolen database alike. Raise them only as far as your proxy handles at peak login times.
See Settings for every setting.