---
title: Configure Password Reset Instructions
slug: configure-password-reset-instructions
createdAt: 2026-03-09T20:46:22.741Z
---



When a user resets their password, Activate displays guidance explaining the password requirements that must be met before the new password will be accepted. These instructions are intended to reflect the password policy configured for the organisation. 

### Default instruction text

By default, the password reset screen shows the following guidance:

- Your password must be at least **X** characters long. 
- Your password should not be easy to guess. 
- Use characters from at least **3** of the following categories: 
  - Uppercase letters, for example **A–Z** 
  - Lowercase letters, for example **a–z** 
  - Numbers, for example **0–9** 
  - Symbols, for example **! @ # $** 

In this text, **X** is derived from the Active Directory environment.

### How Activate determines which instruction text to show

Activate resolves the password instruction text in the following order:

1. **User rules override**
    Activate first checks for instructions defined in the user rules, using the **PasswordResetQuestions** parameter under **Tasks > Passwords**. 
2. **Localised resource string**
    If no user rule instructions are defined, Activate then checks the **passwords/instructions** string in the **en** language resource. 
3. **Hard-coded fallback**
    If neither of the above is available, Activate falls back to the built-in default instruction text. 

This means administrators can override the text without changing code, but if no configured value exists, users will still see the default guidance.

### Where the minimum length comes from

The minimum password length shown to the user is based on the password reset information read from Active Directory. In practice, Activate reads the minimum password length from the domain password settings and uses that value when building the default instruction text. Based on the controller behaviour you provided, this is sourced from the password reset information available for the current user context.

### Suggested note for admins

If a customer reports that the password reset instructions are incorrect, first confirm whether:

- the instruction text has been overridden in **Tasks > Passwords** 
- a localised **passwords/instructions** value is present 
- the environment uses fine-grained password policies that differ from the default domain policy