Guidelines for a Secure Password

Environment

University of Michigan, Weblogin, Password

Issue

List of password complexity requirements and guidelines for choosing a secure password.

Resolution

Your UMICH (Level-1) password must follow these password complexity requirements:

• Must be 15 characters or longer.
• May include spaces.
• Cannot include parts of your name or uniqname.
• Cannot be a password you used before.
• Will be checked for strength as you type it.
• Will be checked against a database of known breached passwords.

In addition to the required password complexity, the following tips can help you protect your password:

• Make your password long and memorable. The longer your password, the better. To help you make a long and memorable password:
  • Use a passphrase.
  • Consider a sequence of multiple, unrelated words.
  • Some people find the Diceware method of generating passwords helpful.
  • Consider using a password manager to generate and store passwords.
• Select a unique password for U-M use. Do not use your UMICH password outside the university for other computing accounts. The university uses strong encryption methods to protect your password. If you use that same password for services that do not offer such protection, you put your UMICH password and account at risk.
• Don't share your password with anyone—not even trusted family members or computer support staff.
• Use a different password for each online account. That way, if one password is compromised, your other accounts are not at risk. It is especially important that you refrain from using your UMICH password for non-university services.
• Use only secure programs when connecting to the U-M computing environment, such as the U-M Virtual Private Network (VPN), to protect your password and your data.
• Check your UMICH password security from time to time and change your password if it is at risk.
• Protect your password. Criminals use malicious email and websites to try to trick you into revealing your password or other sensitive information, or to infect your computer with malware. To learn how to recognize phishing and other malicious email, refer to Phishing & Suspicious Email.
• If you must write down your password to help you remember it, keep it in a safe, secure place, and do not leave it where others could see it.

Additional Information

Need additional information or assistance? Contact the ITS Service Center.