Password minimum length recommendation
Supabase Auth recommends setting a minimum password length of at least 8 characters or more. Anything less than 8 characters is not recommended.
Supabase · Auth · all subjects
authentication/password-security
32 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.
Password character set requirements
Supabase Auth allows configuration of required character types in passwords. The strongest option requires digits, lowercase letters, uppercase letters, and symbols. The allowed symbols are: !@#$%^&*()_+-=[]{};':"\|<>?,./`~
Password strength by character composition
A password of length 8 with digits only requires approximately 2^27 guesses to brute-force. With digits and letters, approximately 2^41 guesses. With digits, lowercase and uppercase letters, approximately 2^48 guesses. With digits, lowercase and uppercase letters, and symbols, approximately 2^52 guesses.
Leaked password protection using HaveIBeenPwned
Supabase Auth can prevent the use of leaked passwords by checking against the open-source HaveIBeenPwned.org Pwned Passwords API. This protects against credential stuffing attacks using known leaked passwords. Leaked password protection is available on the Pro Plan and above.
Reauthentication requirement for password changes
When enabled, users must be recently logged in to change their password without reauthentication. A user is considered recently logged in if the session was created within the last 24 hours. When reauthentication is required, a nonce is sent to the user and must be validated before password change can occur using the reauthenticate() API call.
Current password verification when changing password
Supabase Auth can enforce that users supply their current password when changing their password. When enabled, the password change request validates that the current password is correct before updating to the new password.
Example: reauthenticate and update password with nonce
const { error } = await supabase.auth.reauthenticate() ... const { data, error } = await supabase.auth.updateUser({ email: 'user@email.com', nonce: `${nonce}`, password: "new••••••rd" })
Example: update password with current password verification
const { data, error } = await supabase.auth.updateUser({ email: 'user@email.com', current_password: "correct_current_password", password: "new••••••rd" })
Password hashing algorithm
Supabase Auth uses bcrypt, a strong password hashing function, to store hashes of users' passwords. Only hashed passwords are stored. Each hash is accompanied by a randomly generated salt parameter for extra security. Password hashes cannot be used to impersonate a user.
Encrypted password storage location
Password hashes are stored in the encrypted_password column of the auth.users table. The column name is a misnomer because cryptographic hashing is not encryption, but is kept for backward compatibility.
WeakPasswordError for strengthened password requirements
When existing users sign in with a password that does not meet strengthened password requirements, they will encounter a WeakPasswordError during the signInWithPassword process explaining why the password is considered weak. This applies to new users and existing users changing their passwords.
Backward compatibility for existing user passwords
Existing users can still sign in with their current password even if it does not meet new, strengthened password requirements. However, if they attempt to change their password and the new password falls short of updated standards, they will receive a WeakPasswordError.
Password reset request rate limits
The `/auth/v1/recover` endpoint for password reset requests is rate limited based on the last request of the user. The default limit is auth.rate_limits.password_reset.period window before a new request is allowed to the same user. This limit is customizable.
Email password auth enabled by default
Email authentication is enabled by default in Supabase Auth. You can configure whether users need to verify their email to sign in. On hosted Supabase projects, email verification is true by default. On self-hosted projects or in local development, email verification is false by default. This setting is changed on the Auth Providers page in the dashboard for hosted projects, or in the configuration file for self-hosted projects.
Password reset prevents user enumeration
The resetPasswordForEmail() function does not reveal whether an account exists for a given email address, preventing user enumeration attacks. When no user is associated with the email, Supabase Auth will not send an email, but the function still returns without an error.
Password reset with implicit flow
For implicit flow password reset: (1) Create a reset password page that collects the user's email and calls resetPasswordForEmail with the email and a redirectTo URL pointing to a change password page. (2) Create a change password page at the redirect URL that is accessible only to authenticated users. (3) Collect the new password and call updateUser to update it.
Password reset implicit flow - Swift
Call resetPasswordForEmail() with email and redirectTo URL. Example: supabase.auth.resetPasswordForEmail("valid.email@supabase.io", redirectTo: URL(string: "http://example.com/account/update-password"))
Password reset implicit flow - Kotlin
Call resetPasswordForEmail() with email and redirectUrl. Example: supabase.auth.resetPasswordForEmail(email = "valid.email@supabase.io", redirectUrl = "http://example.com/account/update-password")
Password reset implicit flow - Python
Call reset_password_email() with email and redirect_to. Example: client.auth.reset_password_email('valid.email@supabase.io', {'redirect_to':'http://example.com/account/update-password'})
Password reset implicit flow - Dart
Call resetPasswordForEmail() with email and redirectTo. Example: supabase.auth.resetPasswordForEmail('valid.email@supabase.io', redirectTo: 'http://example.com/account/update-password');
Password reset implicit flow - C#
Call ResetPasswordForEmail() with ResetPasswordForEmailOptions. Example: var options = new ResetPasswordForEmailOptions("valid.email@supabase.io") { RedirectTo = "http://example.com/account/update-password" }; await supabase.Auth.ResetPasswordForEmail(options);
Password reset email template for PKCE flow
The reset password email template should contain HTML with a recovery link using the token hash. The template must include the URL pattern: {{ .SiteURL }}/auth/confirm?token_hash={{ .TokenHash }}&type=recovery&next=/account/update-password
Update password - Swift
Call updateUser() with UserAttributes containing password. Example: supabase.auth.updateUser(user: UserAttributes(password: newPassword))
Update password - Kotlin
Call updateUser() with password property. Example: supabase.auth.updateUser { password = "new_password" }
Update password - Python
Call update_user() with password dictionary. Example: supabase.auth.update_user({'password': 'new_password'})
Update password - Dart
Call updateUser() with UserAttributes containing password. Example: final UserResponse res = await supabase.auth.updateUser(UserAttributes(password: 'new_password'));
Update password - C#
Call Update() with UserAttributes containing Password. Example: await supabase.Auth.Update(new UserAttributes { Password = "new_password" });
Verify current password before password update
When updating a password, you can optionally require users to confirm their current password using current_password parameter (available in supabase-js v2.102.0+ and supabase-kt 3.5.0+).
Verify current password - JavaScript
Call updateUser() with password and current_password. Example: supabase.auth.updateUser({password: 'new_password', current_password: 'old_password'})
Verify current password - Kotlin
Call updateUser() with password and currentPassword. Example: supabase.auth.updateUser { password = "new_password"; currentPassword = "old_password" }
Email sending rate limit for built-in SMTP
The Supabase platform comes with a default email-sending service that has a rate limit based on config value auth.rate_limits.email.inbuilt_smtp_per_hour. The availability is on a best-effort basis. For production use, you should configure a custom SMTP server.
Local development email testing with Mailpit
The Supabase CLI automatically captures emails sent locally using Mailpit. Run supabase status in your terminal to get the Mailpit URL and open it in your browser to find your test emails.