> For the complete documentation index, see [llms.txt](https://0xn3va.gitbook.io/application-security-handbook/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://0xn3va.gitbook.io/application-security-handbook/web-application/authentication/default-passwords.md).

# Default Passwords

## Overview

The page contains recommendations for working with default passwords.

## General

<div align="left"><img src="/files/QJuMWI21M60ZKzo0mFAN" alt=""></div>

* Avoid setting default passwords.
* If you are setting "default" passwords:
  * Generate passwords using a cryptographically strong random generator, see the [Cryptography: Random Generators](/application-security-handbook/web-application/cryptography/random-generators.md) page.
  * Default passwords must follow the password policy, see the [Authentication: Password Policy](/application-security-handbook/web-application/authentication/password-policy.md) page.
  * Default passwords must expire after a short period (for example, 7 days).
  * A user must set a new password after the first authentication with a default password.
  * Prohibit setting a default password as a long-term one.