# Password Security {#password-security}


Password hashing algorithms, policy enforcement, and secure password reset flows.


## Hashing Algorithms {#hashing-algorithms}


Passwords are hashed using **scrypt** (default) with transparent fallback to **bcrypt** for legacy hashes. The `PasswordHashService` supports:

- **Progressive migration**: On login, legacy bcrypt hashes are automatically re-hashed to scrypt.
- **Strategy pattern**: Multiple hashing strategies coexist; the service auto-selects the correct one for verification.


## Password Policy {#password-policy}


Passwords must meet the following requirements (enforced via `class-validator`):

- Minimum **8 characters**
- At least **1 uppercase** letter
- At least **1 lowercase** letter
- At least **1 number**
- At least **1 special character**


## Password Reset Flow {#password-reset-flow}


- Reset tokens are **purpose-scoped JWTs** with a `purpose: 'password-reset'` claim and **10-minute expiry**.
- All existing reset records for a user are **invalidated** when a new reset is requested.
- Reset records are **deleted** after successful password change.
- Responses do not reveal whether the email exists (prevents user enumeration).
- Rate limited: **3 requests per 60 seconds**.



> [!WARNING]
> The password reset endpoint never reveals whether an email exists in the system — both existing and non-existing emails receive the same response.




## Related Pages {#related-pages}


- [Authentication Flows](https://sourcey-gauzy.pages.dev/security/authentication-flows/index.md) — login flow with progressive hash migration
- [Token Lifecycle](https://sourcey-gauzy.pages.dev/security/token-lifecycle/index.md) — JWT token details
- [Rate Limiting](https://sourcey-gauzy.pages.dev/security/rate-limiting/index.md) — per-endpoint limits
- [Security Overview](https://sourcey-gauzy.pages.dev/security/security-overview/index.md) — architecture overview