Strong passwords

Applies to: SQL Server Azure SQL Database Azure SQL Managed Instance Azure Synapse Analytics Analytics Platform System (PDW) SQL database in Microsoft Fabric

Passwords can be the weakest link in a server security deployment. Take great care when you select a password. A strong password has the following characteristics:

• Is at least eight characters long.
• Combines letters, numbers, and symbol characters within the password.
• Isn't found in a dictionary.
• Isn't the name of a command.
• Isn't the name of a person.
• Isn't the name of a user.
• Isn't the name of a computer.
• Is changed regularly.
• Is different from previous passwords.

SQL Server passwords can contain up to 128 characters, including letters, symbols, and digits. Because logins, user names, roles, and passwords are frequently used in Transact-SQL statements, certain symbols must be enclosed by double quotation marks (") or square brackets ([ and ]). Use these delimiters in Transact-SQL statements when the SQL Server login, user, role, or password has the following characteristics:

• Contains or starts with a space character.
• Starts with the $ or @ character.

If used in an OLE DB or ODBC connection string, a login or password containing special characters must be enclosed in braces, and right braces must be escaped. For example, a password my}Pass;word must be specified in the connection string like PWD={my}}Pass;word}.

Related content

• Password policy