What is the maximum password length allowed by AR 25-2?

Answer 1

AR 25-2 specifies MINIMUM password length, but the only limitation on MAXIMUM length is how long a password the OS or application can handle; AR 25-2 does not specify a maximum password length, however,

According to AR 25-2, Section IV, paragraph 4-12 b:

The IAM or designee will manage the password generation, issuance, and control process. If used, generate passwords in accordance with the BBP for Army Password Standards.

BBP for Army password standards are contained in 04-IA-O-0001, paragraph 5A:

(1) All system or system-level passwords and privileged-level accounts (e.g., root, enable, admin, administration accounts, etc.) will be a minimum of 15-character case-sensitive password changed every 60 days (IAW JTF-GNO CTO).

(2) All user-level, user-generated passwords (e.g., email, web, desktop computer, etc.) will change to a 14-character (or greater) case-sensitive password changed every 60 days.