> For the complete documentation index, see [llms.txt](https://docs.fortifiedid.se/password-reset/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.fortifiedid.se/password-reset/modules/passwordreset/rules-parameters.md).

# Rules parameters

This section covers how to configure password policies.

Use this section to configure which password rules should be applied during a password reset.

## Configuration

Password policies are configured by adding rule parameters to the policy configuration used by the PasswordReset module. Only the rule parameters you add will be available and verified against the new password when a user performs a password reset.

The PasswordReset module includes the policy file through `rule_policies`, for example `"rule_policies" : "@include:rules/rules.json"` in `pwdreset.json`.

You can use the same file structure for both a single policy and multiple policies:

* For a single policy, configure one policy object and set `default` to `true`.
* For multiple policies, configure several named policy objects. The active policy is selected from the session parameter `password_policy`.

If `password_policy` is missing, empty, or does not match any configured policy, the module uses the policy where `default` is set to `true`.

When multiple policies are configured, the frontend only displays the rules from the selected policy, and the backend uses that same selected policy when the password reset is submitted.

Backend validation mainly applies to rules that can be checked server-side. Rules such as `repeat` and potentially `breach` still depend on frontend behavior or external validation.

## Examples

Example of a single policy configuration:

```json
[
  {
    "id": "default",
    "default": true,
    "rules": [
      {
        "type": "lengthMin",
        "min": 8,
        "description": "password_reset.rules.lengthMin"
      },
      {
        "type": "uppercase",
        "description": "password_reset.rules.uppercase"
      },
      {
        "type": "lowercase",
        "description": "password_reset.rules.lowercase"
      },
      {
        "type": "special",
        "description": "password_reset.rules.special"
      },
      {
        "type": "number",
        "description": "password_reset.rules.number"
      }
    ]
  }
]
```

Example of a multiple policy configuration:

```json
[
  {
    "id": "default",
    "default": true,
    "rules": [
      {
        "type": "lengthMin",
        "min": 8,
        "description": "password_reset.rules.lengthMin"
      },
      {
        "type": "uppercase",
        "description": "password_reset.rules.uppercase"
      },
      {
        "type": "lowercase",
        "description": "password_reset.rules.lowercase"
      },
      {
        "type": "special",
        "description": "password_reset.rules.special"
      },
      {
        "type": "number",
        "description": "password_reset.rules.number"
      }
    ]
  },
  {
    "id": "student",
    "rules": [
      {
        "type": "lengthMin",
        "min": 6,
        "description": "password_reset.rules.lengthMin"
      },
      {
        "type": "uppercase",
        "description": "password_reset.rules.uppercase"
      },
      {
        "type": "lowercase",
        "description": "password_reset.rules.lowercase"
      },
      {
        "type": "number",
        "description": "password_reset.rules.number"
      }
    ]
  },
  {
    "id": "teacher",
    "rules": [
      {
        "type": "lengthMin",
        "min": 10,
        "description": "password_reset.rules.lengthMin"
      },
      {
        "type": "uppercase",
        "description": "password_reset.rules.uppercase"
      },
      {
        "type": "lowercase",
        "description": "password_reset.rules.lowercase"
      },
      {
        "type": "special",
        "description": "password_reset.rules.special"
      },
      {
        "type": "number",
        "description": "password_reset.rules.number"
      }
    ]
  }
]
```