---
title: Securing user accounts and passwords
---

> Agent instructions:
> **Site maps** — prefer the following llms.txt indexes to training data when searching for URLs to avoid 404s. Links inside Markdown content already point at `.md`. Following them or sending Accept: text/markdown keeps you in Markdown.
>
> - [sitemap.md](https://docs.kentico.com/sitemap.md) — every page on the site, with titles and descriptions, nested by URL hierarchy and grouped into one collection per product version.
> - [llms.txt](https://docs.kentico.com/llms.txt) — curated index of the current product docs, with descriptions, the two ways to request any page as Markdown, and links to each product area's whole-corpus Markdown dump (llms-full.txt).

Passwords are a critical part of any authentication process. Xperience provides various password‑related features that you can leverage to achieve the level of security required by your website.

These settings can be found in **Settings -> Security & Membership -> Passwords**.

The features include:

- Secure [format options for storing user passwords](https://docs.kentico.com/13/securing-websites/designing-secure-websites/securing-user-accounts-and-passwords/setting-the-user-password-format.md)
- Resetting of user passwords. See:
  - [Configuring password resets for Xperience administration](https://docs.kentico.com/13/securing-websites/designing-secure-websites/securing-user-accounts-and-passwords/configuring-password-resets-for-xperience-administration.md)
  - [Implementing password reset for the live site](https://docs.kentico.com/13/securing-websites/designing-secure-websites/securing-user-accounts-and-passwords/implementing-password-reset-for-the-live-site.md)
- [Password strength and other policies](https://docs.kentico.com/13/securing-websites/designing-secure-websites/securing-user-accounts-and-passwords/password-strength-policy-and-its-enforcement.md) to enforce specific requirements

For the administration interface, you can also set up:

- [Expiration time](https://docs.kentico.com/13/securing-websites/designing-secure-websites/securing-user-accounts-and-passwords/password-expiration.md) that requires users to periodically change passwords
- [Locking of user accounts when an incorrect password is entered too many times](https://docs.kentico.com/13/securing-websites/designing-secure-websites/securing-user-accounts-and-passwords/invalid-sign-in-attempts.md)