Password Terms of Use

In order to protect the IT infrastructure, it is essential that users only have access to services and data which they are actually permitted to use (authorisation). In this context, it is essential that login details (UserID and password) are used securely.

These terms of use set out a minimum standard. It is also permitted to use rules and regulations which go above and beyond these terms of use.

These terms of use apply to login details issued or managed by the Vienna University Computer Center (ZID) as part of the IT services operated by the ZID (such as the u:account UserID). These passwords are referred to below as ZID passwords.

A ZID password must be designed in such a way that it provides adequate protection against foreseeable attacks. This means a ZID password 

• is at least 12 characters in length; 
• contains 
  • at least 1 upper-case letter (A–Z) and
  • at least 1 lower-case letter (a–z) and, in addition,
  • at least 1 digit (0–9) or 1 special character (!"$&/()=?+*_.,;^|[]-)
• is not the same as a UserID; 
• differs significantly from other passwords (such as those for social media or online shops) and from your previous ZID password; in particular, it does not consist of sequential numbers (such as 2024, 2025, 2026, etc.);
• is not used for multiple accounts or services;
• is not easy to guess;
• is not included in common password lists and
• is based on best practice (see below). 

These characteristics are mandatory for all ZID passwords, but are not technically enforced in all systems. Further characteristics may be defined and published by the ZID as required (for example, in the event of current threat scenarios).

The u:phone profiles managed by the ZID are exempt from the above requirements. For these, PINs with a minimum length of 6 characters are sufficient. Existing Wi-Fi passwords generated by the ZID system do not need to be changed.

Personal ZID passwords must be kept confidential, even from superiors, deputies, IT service providers, etc. They must not be stored (for example, in the department’s safe) for use by third parties in case of emergency.

ZID passwords for non-personal accounts may only be disclosed to authorised persons.

These terms of use set out the mandatory minimum requirements for ZID passwords in order to ensure secure IT operations.

However, these measures alone do not automatically guarantee a high level of security for a ZID password. For example, Password123! or UniPassw0rt! may meet the minimum requirements for length and character types, but are still not secure passwords (it is generally recommended that you do not use any such example passwords).

A secure password should, as far as possible,

• not contain any personal details (such as your name, date of birth, address, or the names of family members or pets);
• be rare or occur randomly; 
• not contain simple patterns (such as 123456 or quertz);
• be long (up to 127 characters are possible).

Please consult our password tips.

We strongly recommend using a password manager to generate and store secure passwords.

A password manager may be used if it  

• is in line with the current state of the art;
• is cryptographically secure, and
• protects passwords from third parties, including the operator.

Passphrases are supported, but must consist of (at least 4) randomly selected long words. They must not contain any well-known quotations, idioms, proverbs, titles or easily guessable combinations of words.

For example,

• Strong passphrase: Elderberry_Relief_Jerky_Walking_Codeword
• Weak passphrase: Sun.Moon.and.Stars

(It is generally recommended that you do not use any such example passphrases).

Use a password manager to generate a secure passphrase.

If you have reason to believe that a ZID password may have become known to third parties, a new password must be chosen immediately. 

Account holders must immediately choose a new, previously unused ZID password in the following circumstances:

• loss of a device on which a ZID password has been entered
• compromise of such a device (for example, by malware)
• (suspected) disclosure of the ZID password (for example, in response to a phishing attack) or
• request from IT security. 

For a non-personal account, it is also necessary to select a new ZID password if one of the authorised users loses their authorisation.

The ZID never asks users for their password. 

Users should never disclose their ZID password to the ZID. 

Where necessary, the ZID is entitled to temporarily or permanently block UserIDs, passwords, IP addresses, etc. To lift these restrictions, please contact the ZID Helpdesk.

Users are kindly asked to support the ZID by assisting, where necessary, with the investigation of any security incidents.

If multi-factor authentication is available for a service, the ZID recommends using it. For some IT services you will need to enable multi-factor authentication in order to use them.

ZID passwords should only be entered in login forms for systems operated by the ZID (such as web-based services like u:space and webmail) or for local access (such as logging into a workstation PC).

Services operated by other organisational units of the University of Vienna or by external service providers must not request or process ZID passwords. Instead, the ZID’s Web Single Sign-on should be used. Please contact the ZID for details of the exact conditions. Alternatively, you must set up a separate account management system, which must be clearly identifiable as such.

These terms of use enter into force on 1 September 2026.

The following applies to existing passwords:

• If the password was set before 1 September 2026, the account holder will be asked to change their password in accordance with the new terms and conditions.
• Requests to do so will be sent out in stages.
• Account holders have 8 weeks from the date of receipt of the request to change their password.
• At the end of the 8 weeks the account will be blocked. Users can unblock the account by selecting a new password. Alternatively, the ZID Helpdesk can unblock the account.

In cases of doubt or where interpretation is required, IT security shall clarify the current policy in the first instance, with the CIO doing so in the second and final instance. Amendments and additions must be made in written form.