The declaration to configure passcode policy settings.
| Setting | Type | Required | Default | Manual Install | Supported OS |
|---|---|---|---|---|---|
Require Passcode on Device RequirePasscode If `true`, the system requires the user to set a passcode without any requirements about the length or quality of the passcode. The presence of any other keys implicitly requires a passcode, and overrides this key's value. | boolean | optional | false | ✓Yes | iOS (15.0+)macOS (13.0+)visionOS (2.0+)watchOS (10.0+) |
Require Alphanumeric Passcode RequireAlphanumericPasscode If `true`, the passcode needs to consist of at least one alphabetic character and at least one number. | boolean | optional | false | ✓Yes | iOS (16.2+)macOS (13.1+) |
Require Complex Passcode RequireComplexPasscode If `true`, the system requires a complex passcode. A complex passcode is one that doesn't contain repeated characters or increasing or decreasing characters (such as 123 or CBA). | boolean | optional | false | ✓Yes | iOS (15.0+)macOS (13.0+)visionOS (2.0+)watchOS (10.0+) |
Minimum Passcode Length MinimumLength The minimum number of characters a passcode can contain. Range: 0 - 16 | integer | optional | 0 | ✓Yes | iOS (15.0+)macOS (13.0+)visionOS (2.0+)watchOS (10.0+) |
Minimum Complex Characters MinimumComplexCharacters Specifies the minimum number of complex characters in the password. A complex character is a character other than a number or a letter, such as `&`, `%`, `$`, and `#`. Range: 0 - 4 | integer | optional | 0 | ✓Yes | iOS (16.2+)macOS (13.1+) |
Maximum Number of Failed Attempts MaximumFailedAttempts The number of failed passcode attempts that the system allows the user before it erases or locks the device. After six failed attempts, the device imposes a time delay before the user can enter a passcode again. The time delay increases with each failed attempt. On macOS, set `FailedAttemptsResetInMinutes` to define the time delay. The time delay begins after the sixth attempt, so if `MaximumFailedAttempts` is six or lower, the system has no time delay and triggers the erase or lock as soon as the user exceeds the limit.
After the final failed attempt, the system locks a macOS device, or securely erases all data and settings from an iOS, visionOS, or watchOS device. Range: 2 - 11 | integer | optional | 11 | ✓Yes | iOS (15.0+)macOS (13.0+)visionOS (2.0+)watchOS (10.0+) |
Failed Attempts Reset FailedAttemptsResetInMinutes The number of minutes before the login is reset after the maximum number of failed attempts. Also set the `MaximumFailedAttempts` key for this to take effect. | integer | optional | — | ✓Yes | macOS (13.1+) |
Maximum Grace Period MaximumGracePeriodInMinutes The maximum period that a user can select, during which the user can unlock the device without a passcode. A value of `0` means no grace period, and the device requires a passcode immediately. In the absence of this key, the user can select any period. In macOS, the system translates this to screensaver settings. | integer | optional | — | ✓Yes | iOS (15.0+)macOS (13.0+)visionOS (2.0+)watchOS (10.0+) |
Automatic Device Lock MaximumInactivityInMinutes The maximum period that a user can select, during which the device can be idle before the system automatically locks it. When the device reaches this limit, the device locks and the user must enter the passcode to unlock it. In the absence of this key, the user can select any period. In macOS, the system translates this to screensaver settings. Range: 0 - 15 | integer | optional | — | ✓Yes | iOS (15.0+)macOS (13.0+)visionOS (2.0+)watchOS (10.0+) |
Maximum Passcode Age MaximumPasscodeAgeInDays Specifies the maximum number of days that the passcode can remain unchanged. After this number of days, the system forces the user to change the passcode before it unlocks the device. Range: 0 - 730 | integer | optional | — | ✓Yes | iOS (16.2+)macOS (13.1+) |
Passcode Reuse Limit PasscodeReuseLimit The number of historical passcode entries the system checks when validating a new passcode. The device refuses a new passcode if it matches a previously used passcode within the specified passcode history range. In the absence of this key, the system performs no historical check. Range: 1 - 50 | integer | optional | — | ✓Yes | iOS (15.0+)macOS (13.0+)visionOS (2.0+)watchOS (10.0+) |
Change At Next Auth ChangeAtNextAuth If `true`, the system forces a password reset the next time the user tries to authenticate. If you set this key in a configuration in the system scope (device channel), the setting takes effect for all users, and admin authentication may fail until the admin user password is also reset. | boolean | optional | false | ✓Yes | macOS (13.1+) |
CustomRegex CustomRegex Specifies a regular expression, and its description, to enforce password compliance. Use the simpler passcode settings whenever possible, and rely on regular expression matching only when necessary. Mistakes in regular expressions can lead to frustrating user experiences, such as unsatisfiable passcode policies, or policy descriptions that don't match the enforced policy. 2 subkeys | dictionary | optional | — | ✓Yes | macOS (14.0+) |
└─ Regex Regex A regular expression string to match against the password to determine whether it complies with a policy. The regular expression uses the ICU syntax. The string can't exceed 2048 characters in length. | string | required | — | ✓Yes | iOS (15.0+)macOS (13.0+)visionOS (2.0+)watchOS (10.0+) |
└─ Description Description A dictionary with supported OS language IDs for the keys (such as `en-US`), and values that represent a localized description of the policy that the regular expression enforces. Use the special `default` key for languages that the dictionary doesn't contain. 1 subkey | dictionary | optional | — | ✓Yes | iOS (15.0+)macOS (13.0+)visionOS (2.0+)watchOS (10.0+) |
└─ └─ ANY ANY A localized description. | string | optional | — | ✓Yes | iOS (15.0+)macOS (13.0+)visionOS (2.0+)watchOS (10.0+) |
