Passwords

Passwords authenticate users who connect to Files.com using password-based login methods. These methods include standard username/password authentication and password authentication combined with SSH key authentication.

Password policies control the strength and expiration rules applied to plaintext passwords.

Password Policy

Each site defines a password policy that governs how plaintext passwords must be structured. The policy may define requirements such as minimum length, complexity rules, and expiration periods.

When a user sets or changes a password, the password must satisfy the site's password policy.

Password policies apply only to plaintext passwords. They are enforced whenever a user creates a new password or changes an existing password.

Authentication Methods That Use Passwords

The following authentication methods rely on password credentials:

Default Settings for Passwords

When a new site is created, password settings are enabled to meet the security requirements of most Files.com customers:

Password Restrictions

Administrators can define up to 6 different password requirements to meet or exceed your organization's security requirements for secure passwords:

After modifying the password restrictions, existing users must comply with the new rules when resetting their current passwords, and new users must follow these rules when creating their passwords.

Changing your password restrictions does not force existing users to change their current passwords.

Prevent Use of Breachable Passwords

Files.com checks passwords against commonly used passwords and passwords exposed through other services. These values are easier to guess or may already be known to someone else. A matching password is flagged as breachable, allowing your site to prevent its reuse.

Once enabled, this setting prevents existing and new users from setting passwords that match the filter. Existing passwords matching the filter are flagged as breachable but existing users are not forced to change their current passwords.

Password Expiration

Many organizations require a maximum age for passwords. Use this option if your organization requires passwords to be changed at fixed intervals to maintain compliance. The password expiration setting does not apply to Shared/Bot users.

After modifying the password expiration interval, the new interval applies to existing and new users. For example, if an existing user last reset their password 120 days ago and the new expiration interval is set to 90 days, their password expires immediately, and the user is forced to reset their password the next time they attempt to log in.

Reconsidering Password Expiration

Files.com automatically limits repeated failed login attempts and lets administrators unlock users. Consider whether mandatory password expiration adds a benefit required by your organization. The Federal Trade Commission article Time to rethink mandatory password changes summarizes the research: "Research suggests frequent mandatory expiration inconveniences and annoys users without as much security benefit as previously thought, and may even cause some users to behave less securely."

Password Expiration Reminders

The system sends password expiration reminders to the user at 28, 14, 7, and 1 day(s) before expiration.

Per-User Password Expiration Override

Site Administrators can override the site-wide password expiration setting for any user on the site. Workspace Administrators can set overrides for users within the Workspaces they administer, including Workspace Administrator accounts. For each user, choose from these three options: Use Site Setting, a custom day count, and Never Expires.

Use Site Setting applies the site-wide expiration interval to that user and is the default setting. A custom day count sets a user-specific interval, independent of the site-wide policy. Never Expires prevents that user's password from expiring regardless of the site-wide setting.

Never Expires is designed for service accounts and automation users. These accounts store credentials in external systems or scripts where a forced password reset breaks an integration.

Requiring a Password Change

To require an individual user to change their password, enable Require password change on next login in that user's Authentication settings.

Generating Passwords

When you are using the web interface, each password field lets you automatically generate the password and copy the new password. Generated passwords use all of your site's password settings, including length and complexity.

Resetting User Passwords

Site Administrators can set or reset the password for any user on the site. Workspace Administrators can do so for users within their Workspace. Group Admins need the site-wide edit and password-reset capabilities, and can act only on users whose Primary Group is one of the groups they administer. Those capabilities never allow setting or resetting passwords or resetting 2FA for accounts with Site Administrator, Read-only Site Administrator, or Workspace Administrator access on the Group Admin's own site, even with a matching Primary Group. Partner Admins can set or reset passwords for users within their own Partner when Allow credential changes is enabled for that Partner.

A parent-site account's Child Site Administrator access does not exclude it from password or 2FA resets by a Group Admin on the Parent Site. The Primary Group and enabled-capability requirements still apply.

These permissions govern direct administrative password changes. A delegated administrator who can change a user's email address can also redirect that user's password recovery emails, even without permission to change the password directly. Review Delegated Administration when deciding which account-management capabilities to delegate.

When you reset a password in the web interface, you are prompted to reauthenticate to confirm the change.

Password Recovery via Email

Password recovery via email is enabled by default so users can regain access without asking an administrator to set a new password. The user's primary email address is the recovery channel. A person who can receive mail at that address can use a recovery link to set the user's password.

On your site's login page, choose Forgot your password?, enter the username or email address, and select Recover Password. Files.com sends a link to the primary email address in the user's settings. It does not send the link to Additional Email Recipients. If several accounts share an email address, enter the username to identify the account you want to recover.

Recovery is available to users who sign in with a password and have an email address. Shared/Bot users cannot use it. Users with Email signup authentication receive their signup email instead. Users who sign in through SSO must recover access through their identity provider; Files.com does not send them a password recovery link.

A recovery link is valid for 48 hours. Requesting a new link replaces the previous one, so use the most recent email. Changing the user's password or email address invalidates any outstanding recovery link.

Resetting a password does not remove enrolled Two-Factor Authentication (2FA) methods. Signing in still requires the user's second factor. An enrolled authenticator app or hardware key keeps mailbox access alone from being enough to sign in. Email verification does not provide that separation because it uses the same mailbox.

Permission to change a user's email address includes the ability to redirect future recovery emails. This applies to a Group Admin with edit capability for that account and to a Partner Admin, even when direct password changes are not allowed. Group Admins cannot edit accounts with Site Administrator, Read-only Site Administrator, or Workspace Administrator access on their own site, including their email addresses. Child Site Administrator access does not remove an otherwise eligible parent-site account from this email-editing authority. Delegated Administration explains which controls to consider when granting that account-management access.

To require administrator assistance for forgotten passwords, disable Password recovery via email. Disabling it also invalidates outstanding recovery links. It does not remove delegated administrators' other account-management capabilities.

Password recovery emails are sent from no-reply@files.com unless you have configured Custom SMTP. If the email is missing, check your spam folder.

Importing Passwords From Another System

When migrating users from another platform, existing password hashes can be imported so that users can continue using their current passwords.

To import password hashes, set the authentication method to Imported hash and provide the hash value in the Password field.

Files.com detects supported hash formats automatically based on the hash prefix.

Imported hashes bypass the password policy validation because the plaintext password is not available during migration.

First Login Behavior

When a user logs in for the first time after a hash import, Files.com verifies the provided password against the imported hash.

After successful authentication, the password is converted to Files.com's internal password storage format (PBKDF2). This conversion occurs automatically and does not require administrator intervention.

Password Changes After Import

When a user changes their password after the initial login, the new password must satisfy the site's password policy.