Configure password requirements

Every administrator who signs in to CultureMonkey with an email and password is protected by a single, consistent set of password rules. Those rules are the same for every account and every admin, and they are enforced by the platform itself rather than being something you switch on or tune.

This guide explains exactly what those rules are, why they work the way they do, what happens when a password is reset or a session ends, and how single sign-on (SSO) changes the whole equation. If you came here looking for a screen where you set a minimum length or a rotation schedule, the short answer is below, and the longer answer (with the reasoning) follows.

The password rules CultureMonkey enforces

When an admin sets or changes a password (during signup, when accepting an invite, or through a reset), the platform validates it against a fixed set of requirements. A password is accepted only if it meets all of them:

If any one of these is missing, the platform rejects the password and the admin is asked to choose a stronger one. There is no partial credit and no "weak but allowed" option: the password either satisfies every rule or it is not accepted.

The guidance shown to people while they type mirrors these rules. The prompt reads, in effect: "Create a strong password with a minimum of 8 characters, that has a combination of lowercase and uppercase alphabets, numbers and special characters," with an example like aHix!85z. That example is a compact illustration of a valid password: it is longer than eight characters, and it mixes all four required character types.

Are these rules configurable?

No. This is the question most people arrive with, so it is worth being direct: the password rules are fixed and cannot be changed from within CultureMonkey. There is no account setting, no admin panel toggle, and no per-admin override for password length, character requirements, expiry, or history. The same policy applies to every account on the platform.

This is a deliberate design choice rather than a missing feature. A single, well-chosen baseline has a few advantages over a configurable one:

• It cannot be weakened. Configurable policies are only as strong as the person configuring them. A fixed floor removes the risk of an account accidentally allowing four-character passwords.
• It is predictable. Support, security reviews, and your own internal documentation can all rely on one known standard.
• It is consistent for everyone. Every admin across every account is held to the same bar, which keeps the whole platform's login surface uniformly protected.

If your organization's security policy requires something stricter (say, a 12-character minimum, mandatory rotation, or hardware-key enforcement), the right path is not to reconfigure the password rules. It is to move admins onto SAML single sign-on, where your own identity provider owns the policy. More on that below.

How passwords are stored

Passwords are never stored in a form anyone can read. When an admin sets a password, CultureMonkey runs it through bcrypt, a deliberately slow, salted hashing algorithm, and stores only the resulting hash. The original password is not written to the database, the logs, or any export.

Because of this, no one, including CultureMonkey staff, can look up or tell you an existing password. The only way to regain access to an account is to set a new password through the reset flow. This is why "please send me my password" can never be honored: the plain text simply does not exist anywhere to be sent.

Resetting a forgotten password

When an admin cannot sign in, the recovery path is a self-service password reset from the login screen.

1. 1Start the reset - On the sign-in page, the admin chooses the forgot-password option and enters the email address on their account.
2. 2Receive the email - If that email belongs to a verified admin, CultureMonkey sends a message containing a one-time reset link.
3. 3Open the link in time - The reset link is valid for 24 hours. After that it expires and the admin has to request a fresh one.
4. 4Set a new password - The new password must satisfy the same rules described above, and it must match the confirmation field. Once saved, the reset link is consumed and can't be reused.

A couple of details are worth knowing. First, the reset flow only works for accounts that are verified and have login access; an admin who was invited but never confirmed their email is prompted to complete that invite instead (see Invite and manage administrators). Second, requesting a reset for an unrecognized email does not reveal whether that address has an account, which avoids leaking who does and does not have admin access.

Password expiry, rotation, and reuse

There is no forced password expiry in CultureMonkey. Admins are not prompted to change their password on a schedule, and there is no built-in rule preventing an admin from reusing a password they have used before.

This aligns with current security guidance, which has largely moved away from mandatory periodic rotation. Forcing frequent changes tends to push people toward predictable patterns (adding "1", then "2", then "3") that are weaker, not stronger. A long, unique password that is only changed when there is a reason to (a suspected compromise, an offboarding, a device left unattended) is generally the healthier practice.

If your own policy mandates rotation, you have two options: manage it as an operational process (ask admins to reset periodically), or, more robustly, adopt SSO so that your identity provider enforces rotation centrally.

Sessions and staying signed in

Once an admin signs in successfully, CultureMonkey keeps them signed in using a session cookie. There is no separate idle-timeout or forced re-authentication interval configured on top of the standard session, so admins generally stay signed in until they explicitly sign out or their browser session ends.

Two habits keep this safe in practice:

• Sign out on shared or public machines. The most reliable way to end a session is to use the sign-out action, which clears the session immediately.
• Lock the device. On a personal machine, an OS-level lock screen protects an active session when you step away.

How single sign-on changes everything

Single sign-on is the answer to almost every "can we make the password policy stricter?" question, because with SSO the password policy is no longer CultureMonkey's to enforce. It becomes your identity provider's.

CultureMonkey supports SAML SSO. There are two relevant behaviors, and they are typically enabled by your CultureMonkey contact rather than from a self-serve toggle:

• Show an SSO login button. With SSO enabled, the sign-in page offers a "sign in with SSO" option alongside the normal email-and-password form. Admins can use whichever they are set up for.
• Redirect to SSO and hide local login. A stricter mode hides the email-and-password form entirely and sends admins straight to your identity provider. In this mode, the CultureMonkey password rules become irrelevant for those users, because they never enter a CultureMonkey password at all.

When admins authenticate through your identity provider, your policy governs everything: length, complexity, rotation, multi-factor authentication, conditional access, device trust, and deprovisioning. If someone leaves your organization and you disable them in your IdP, their access to CultureMonkey ends there too, without anyone needing to remember to remove them separately.

app.culturemonkey.io/signin

Best practices for admin passwords

Even with a solid baseline enforced for you, a few habits meaningfully raise the bar:

• Use a password manager. Let it generate a long, random, unique password for CultureMonkey so you never reuse one from another site.
• Never share admin credentials. If two people need access, give them two admin accounts. Shared logins make it impossible to tell who did what and are much harder to revoke cleanly. See Invite and manage administrators.
• Remove access promptly. When an admin leaves or changes roles, revoke their access rather than relying on a password change.
• Prefer SSO where you can. It centralizes control, adds MFA, and ties CultureMonkey access to your existing joiner-mover-leaver process.

Frequently asked questions

Can I set a minimum password length longer than 8 characters?

Not within CultureMonkey. The 8-character minimum is fixed. If you need a longer minimum, enforce it through your identity provider with SAML single sign-on, which replaces the CultureMonkey password entirely.

Can I force admins to change their passwords every 90 days?

There is no built-in expiry or forced-rotation feature. You can ask admins to reset periodically as an operational process, or use SSO so your identity provider handles rotation centrally.

Someone forgot their password. Can you tell me what it is?

No. Passwords are stored as bcrypt hashes and cannot be recovered by anyone, including CultureMonkey. The admin should use the forgot-password link on the sign-in page to set a new one.

Does CultureMonkey support two-factor authentication for admins?

Admin login itself is email and password (or SSO), without a separate second factor layered on top. To require MFA, enable it at your identity provider and route admins through SAML SSO.

If we turn on SSO, do the CultureMonkey password rules still apply?

For admins who sign in through SSO, no. They authenticate against your identity provider and never enter a CultureMonkey password, so your policy governs everything. In the stricter SSO mode, the local password form is hidden entirely.

Why can't I find a password settings page?

Because there isn't one. The rules are intentionally fixed so they can't be weakened. The lever for a different policy is SSO, not a settings screen.

Where to go next

• Move admins onto your identity provider: Set up SAML single sign-on
• Add or remove admin accounts: Invite and manage administrators
• Understand who can see and do what: Manage access and roles