# Changing your Password Users can change their passwords by visiting their Profile page and selecting the Change Password tab. To change a password enter the current password and then the new password. TrialGrid requires you to enter the new password twice as a confirmation. ## Requirements TrialGrid enforces a number of restrictions on passwords: - A password must contain at least 9 characters (Organizations can configure a higher minimum) - A password cannot be too similar to a user's username, email address, firstname or lastname - A password cannot appear in the system list of common passwords - A password cannot be made up of all numbers - A password cannot be one of your 5 previous passwords. TrialGrid support can change this number for an Organization. - A password cannot be a password which has been exposed in a data breach, when the breach service responds. If it does not respond in time, the password is accepted. TrialGrid uses the [HIBP](http://haveibeenpawned.com/Passwords) API. TrialGrid does not send your password to this service; [k-Anonymity](https://haveibeenpwned.com/API/v3#PwnedPasswords) is used. TrialGrid support can turn this check off for an Organization. ## Organization password policies Additional password requirements can be specified for each Organization in TrialGrid: - A password must contain an uppercase letter - A password must contain a lowercase letter - A password must contain a number - A password must contain one of these characters: *!@#$%^&** - Password expiry after a specified number of days - A higher minimum password length than the system default of 9 characters The active requirements for your Organization will be displayed on the Change Password page. ## Accounts that have not been used If your Organization does not have a password expiry policy, a user who has not logged in for 365 days must reset their password before they can log in again. ## Account lockout After 5 failed login attempts in a row, TrialGrid locks the account and emails the user a link to reset their password. A successful login resets the count. The same limit applies to logging in to the API. ## Forcing password resets TrialGrid users can be forced to change their password before being able to log in again. Contact TrialGrid support to request this for one or more users.