Password Security

During Digital Banking enrollment, users must create a username and password to access their account. This section describes the requirements and password validators we use to ensure the creation of strong passwords. For troubleshooting username and password issues, go to Troubleshooting & Support.

Username and Password Requirements

Usernames must be less than 150 characters and may contain letters, numbers, or any of the following special characters:  _, @, +, ., -. Usernames are not case sensitive. User passwords can be 4,096 characters or fewer. The default minimum password length is 8 characters and the minimum can be configured for your financial institution. We highly recommend a minimum password length of at least 10 characters. To configure the minimum password length or any other password conditions, contact support@narmi.com.

Password Validators

By default, we apply the following password validators:

• User similarity – Ensures that the password is not too similar to the user's username, first name, last name, or email
• Common password – Ensures that the password is not in the 20,000 most common passwords
• Numeric password – Ensures that the password is not entirely numeric

Each password validator provides help text to explain the requirements to the user, validates a given password, and returns an error message if it does not meet the requirements. 

Additional Password Conditions

Each financial institution has the ability to set their own requirements for the parameters below. Minimum requirements can be set for each character that is expected to occur within a password. To configure any of the following password conditions, please contact support@narmi.com.

• Password number minimum – Validates whether the password meets the minimum amount of numbers required during the password generation
• Password uppercase letter minimum – Validates whether the password meets the minimum amount of uppercase letters required during the password generation
• Password lowercase minimum – Validates whether the password meets the minimum amount of lowercase letters required during the password generation
• Password symbol minimum – Validates whether the password meets the minimum amount of symbols required during the password generation

Note: There is no default expiration of a user's password. We do not prompt users to change their passwords after a given amount of days.