User passwords

If you use a password to sign in to GitLab, a strong password is very important. A weak or guessable password makes it easier for unauthorized people to sign in to your account.

Some organizations require you to meet certain requirements when choosing a password.

Improve the security of your account with two-factor authentication.

Choose your password

You can choose a password when you create a user account.

If you register your account using an external authentication and authorization provider, you do not need to choose a password. GitLab sets a random, unique, and secure password for you.

Change your password

You can change your password. GitLab enforces password requirements when you choose your new password.

Change a known password

1. On the left sidebar, select your avatar.
2. Select Edit profile.
3. On the left sidebar, select Password.
4. In the Current password text box, enter your current password.
5. In the New password and Password confirmation text box, enter your new password.
6. Select Save password.

Change an unknown password

If you do not know your current password, select Forgot your password? from the GitLab sign-in page and complete the form.

If you enter a verified email address for an existing account, GitLab sends a password reset email. If the provided email address isn’t associated with an existing account, no email is sent.

In both situations, you are redirected to the sign-in page and see the following message:

“If your email address exists in our database, you will receive a password recovery link at your email address in a few minutes.”

Password requirements

Your passwords must meet a set of requirements when:

• You choose a password during registration.
• You choose a new password using the forgotten password reset flow.
• You change your password proactively.
• You change your password after it expires.
• An administrator creates your account.
• An administrator updates your account.

By default GitLab enforces the following password requirements:

• Minimum and maximum password lengths. For example, see the settings for GitLab.com.
• Disallowing weak passwords.

Self-managed installations can configure the following additional password requirements:

• Password minimum and maximum length limits.
• Password complexity requirements.

Block weak passwords

GitLab disallows weak passwords. Your password is considered weak when it:

• Matches one of 4500+ known, breached passwords.
• Contains part of your name, username, or email address.
• Contains a predictable word (for example, gitlab or devops).

Weak passwords are rejected with the error message: Password must not contain commonly used combinations of words and letters.