The Recommended security level includes strict password requirements, checks against known breached passwords, and follows security best practices and industry standards. You can create a custom password security level for team members (admins and agents) if your requirements differ for these users.

What's my plan?
All Suites Team, Growth, Professional, Enterprise, or Enterprise Plus
Support Team, Professional, or Enterprise

Summary: ◀▼

You can set password security levels for team members and end users to meet your security or compliance needs. The Recommended level uses strong password rules, checks for breached passwords, and does not require expiration. You can also create a Custom password policy for team members, and admins can change the level, which may force password updates and lockouts.

Location: Admin Center > Account > Security
On August 17, 2026, Zendesk began removing the Low, Medium, and High password security levels for team member authentication and migrating all accounts to the Recommended security level for team members. In addition, Zendesk updated certain custom password policy settings to align with new standards. See the announcement for details.
A password security level refers to a password's strength or complexity. The following security level options are available:
  • For team members: Recommended and Custom
  • For end users: Recommended, Low, Medium, and High

The Recommended security level includes strict password requirements, checks against known breached passwords, and follows security best practices and industry standards. You can create a custom password security level for team members (admins and agents) if your requirements differ for these users.

You can use a single sign-on (SSO) solution instead of Zendesk passwords. Zendesk recommends using SSO, if possible.

This article covers the following topics:

  • About password security levels
  • Setting a custom password security level for team members
  • Changing the password security level

About password security levels

Many companies require complex passwords as part of their security policies. Certain regulations, such as the General Data Protection Regulation (GDPR), require organizations to take steps to protect personal data, including using complex passwords.

The Recommended password security level meets or exceeds security requirements for most companies. When this password security level is in place, passwords don't expire. However, passwords must meet the following requirements:
  • Must be at least 12 characters and not exceed 72 characters
  • Must include uppercase and lowercase letters (a-z and A-Z)
  • Must include a number (0-9)
  • Must include a special character (!, @, #, %, etc.)
  • Must not include the word "Zendesk"
  • Must not resemble an email address
  • Must pass a check against a list of known breached passwords
  • Five attempts are allowed before a temporary 10-minute lockout
Note: The password length limit is a reliability measure to prevent a form of Denial-of-Service (DoS) attack called “long password denial of service.” To learn more about Zendesk security practices, visit the Zendesk Trust Center.

The Low, Medium, and High password security levels for end users have lower security requirements. Zendesk recommends changing the security level to Recommended if you are using any of these other levels.

Setting a custom password security level for team members

The Custom security level is available only for team members and can be used if you have additional compliance requirements. If you create your own custom password policy, Zendesk recommends that the requirements are at least as strong as the Recommended level.

Note: Changes to a custom password security policy won't impact expiration rules for existing passwords. For example, if you change your password expiration from 30 days to Never, passwords for current users will still expire after 30 days. When they reset their password, the new expiration rule is applied.

Most of the custom options are self-explanatory except for the following:

  • Number of previous passwords to reject - New passwords must be different from the number of previous passwords you set.
  • Failed attempts until lockout - If a team member fails to enter their password correctly the number of times you specify in a row, they are locked out for a certain period of time. They cannot sign in again until the lockout expires.
To set a custom password security level for team members
  1. In Admin Center, click Account in the sidebar, then select Security > Team member authentication.
  2. Select Custom in the Password level drop-down.
  3. Click the Edit link to set password requirements.
  4. Select your custom password requirements.
  5. Click Set.
  6. Click Save.

Changing the password security level

You must be an admin to change the password security level. When you increase the security level, all passwords, regardless of security level, expire in 5 days. All team members must change their passwords to comply with the new security level.

Increasing the password security level can cause some passwords to expire instantly. If a password is older than 90 days and the security level is increased to a level with an expiration restriction, that password is considered expired. Zendesk sends email notifications to admins and agents three days before a password expires, and then on the day it expires. End users don’t get any emails notifying them that their password will expire.

To change the password security level

  1. Open the password security settings for team members or end users.
    • In Admin Center, click Account in the sidebar, then select Security > Team member authentication.
    • In Admin Center, click Account in the sidebar, then select Security > End user authentication.
  2. Select a Password level, then click Save.
Powered by Zendesk