Characters of Security: New Password Terms of Use

IT security

As of 1 September 2026, the new password terms of use have come into effect at the University of Vienna. Higher password quality standards aim to contribute to the protection of the university’s data and infrastructure.

[Translate to English:] Illustration by Storyset

Universities are increasingly targeted by cyberattacks. Compromised credentials are a common entry point: even a single weak password or one intercepted through phishing can give attackers access to sensitive data and systems – ranging from research data and personal information to core university services.

To make IT at the University of Vienna more secure, new Terms of Use for passwords used within the ZID’s IT services (such as the u:account password) have been in effect since 1 September 2026.
 

What is changing?

Since the terms of use came into effect, passwords must meet higher-quality requirements for length and complexity. Among other things, they must:

  • consist of at least 12 characters (previously 10)
  • contain at least 3 character types (previously 2)

All users are therefore requested to change their existing u:account passwords in accordance with the new requirements. 

How can you change your password?

Please open the form Changing password and set a new u:account password.

This ensures that passwords meet the technically verifiable criteria for length and character types. The aim is to work together to increase the long-term protection of our digital infrastructure and sensitive data.

“By using a secure password, we all play a part in safeguarding the university’s operational capacity and ensuring the reliable availability of its services. IT security is a shared responsibility between the university and all its users,” explains Rainer Jantscher, Head of the IT Core Services, Security & Privacy department and Deputy Head of the ZID.
 

What requirements must a password meet?

As of 1 September, a ZID password must meet the following criteria:

  • At least 12 characters in length
  • Contains at least 1 upper-case letter and 1 lower-case letter, and additionally 1 digit or 1 special character

  • Is not identical to a UserID

  • Differs significantly from other passwords (such as those used for social media or online shops) as well as the previous ZID password – specifically avoiding sequential numbers (2024, 2025, 2026…)

  • Is not reused across multiple accounts

  • Is not easy to guess

  • Is not listed in common password dictionaries

  • Follows best practices

“These are the minimum requirements for secure IT operations. The password should be as long and as random as possible; in particular, it should not contain simple patterns like 12345. We therefore recommend using a password manager to generate secure passwords and store them securely. A secure password – ideally in combination with a password manager—makes it significantly harder for attackers,” says Kerstin Ammann-Silvaggio, Head of the IT Security team of the ZID.

All password requirements and best practices are available in the password terms of use. Users can also access the password tips of the ZID.

What is a password manager?

A password manager is software that helps users create, store, manage, and use unique access credentials. Various technical solutions exist, such as built-in browser features, locally installed software, cloud-based solutions, or features integrated into operating systems (such as Passwords on iOS/macOS). 

More information on the topic of password managers

Beware of Phishing

“Never enter your password on a website that you accessed via a link in an e-mail. To change their password, users should therefore navigate to the relevant ZID web pages independently,” explains Michael Beck, member of the ZID IT Security team. 

On the ZID website, users will find engaging videos, quizzes, and tips to help them use IT securely – for example, how to handle e-mails correctly.


If you have any questions, the IT Security Servicedesk form and the ZID Helpdesk are available to assist you.

Back