Short answer: Out of the box, Odoo lets you set a minimum password length and nothing more. It doesn’t require uppercase letters, digits or symbols, it doesn’t stop users reusing old passwords, and passwords never expire. To add those rules, install Password Policy Pro by Vayasoft. You switch on each rule from one settings screen, and users see a live green or red checklist while they type.
What does Odoo’s password setting cover?
Odoo has a Minimum Password Length setting, and that’s all. Nothing checks complexity or reuse, and nothing reminds users to change an old password. For companies with audits, ISO 27001 or client security questionnaires, that usually isn’t enough.
Standard Odoo vs. Password Policy Pro
| Rule | Standard Odoo | Password Policy Pro |
|---|---|---|
| Minimum length | Yes | Yes |
| Uppercase, lowercase, digit and special-character rules | No | Yes, each switched on or off |
| Live checklist on the sign-up and reset pages | No | Yes, green or red as the user types |
| “Passwords match” check on confirm | No | Yes |
| Block reuse of the last N passwords | No | Yes, by hash comparison |
| Password expiry | No | Yes, in days |
| Expiry reminder emails | No | Yes |
| Password status on the Users list | No | OK, Due Soon or Expired |
How do I set a password policy in Odoo?
- Install Password Policy Pro. Default rules apply straight away: 8 characters, with an uppercase letter, a lowercase letter and a digit.
- Go to Settings > Technical > Security > Password Policy. Every setting sits on one screen, grouped as Complexity, Expiry and Reuse.
- Adjust the Complexity rules, for example raise the minimum length or require a special character.
- To use expiry, set Password Expiry (days) above 0 and choose how many days’ notice to give in Remind Before Expiry.
- To block reuse, set Block Reuse Of Last N Passwords above 0.
- Click Save. The checklist, reuse check, status badges and reminder emails start working at once.
Does it cover every way a password gets set?
Yes. A user changing their own password, an administrator setting one from the Users list, and a new user signing up all go through the same check. There’s no separate path that skips the policy.
Reuse blocking never stores a plain-text password. It compares against hashes, using the same one-way method Odoo already uses to check a login.
Frequently asked questions
Does it work on Odoo Community?
Yes. It works on Community and Enterprise, and doesn’t depend on any Enterprise feature or other paid app.
Will it apply to passwords my users already have?
Odoo doesn’t record when a password was last changed. So each existing user’s expiry countdown starts from their account creation date, the closest available estimate. Reuse history starts building from each user’s next password change.
Do I need developer mode?
No. Everything is set from one settings screen, with no XML and no Studio.
Pair it with mandatory 2FA
A strong password policy is one half of a safe login. The other is mandatory two-factor authentication, especially for admin accounts.
Talk to Vayasoft
Preparing for an audit or a client security questionnaire? Vayasoft can harden your Odoo setup, covering passwords, 2FA, access rights and admin accounts. Book a free 30-minute security review.
Links: Password Policy Pro on the Odoo App Store · Password Policy Pro product page
About Vayasoft: Vayasoft is an official Odoo Ready Partner based in India. We build Odoo apps and implement, upgrade and support Odoo for trading, manufacturing, solar EPC, retail and healthcare businesses.
Pingback: How to Make Two-Factor Authentication Mandatory in Odoo