Security basics
PCI DSS Password Requirements: Compliance Guidelines
PCI DSS mandates strict password policies to protect cardholder data. This guide outlines the essential requirements for secure password management and compliance.
1 min readUpdated: 02/16/2026Author: GeneratePasswordTo Editorial Team
Key PCI DSS Password Requirements
PCI DSS enforces the following password rules to ensure data security:
1. Password Complexity: Passwords must include a mix of uppercase, lowercase, numbers, and special characters.
2. Password Length: Minimum length of 7 characters, with a recommended minimum of 12 characters.
3. Password Expiration: Passwords must be changed every 90 days, unless the system supports longer intervals with risk assessments.
4. Multi-Factor Authentication (MFA): Required for systems handling cardholder data.
5. Account Lockout: Systems must lock accounts after a certain number of failed login attempts to prevent brute-force attacks.
- Minimum 7-character passwords with complexity.
- Password changes every 90 days (or longer with risk analysis).
- MFA required for high-risk systems.
- Account lockout mechanisms for failed attempts.