# Auth Stack - how to customize cognito password policy

**URL:** <https://discourse.sst.dev/t/auth-stack-how-to-customize-cognito-password-policy/2711>\
**Category:** General\
**Created:** [July 25, 2022, 10:14am UTC](https://discourse.sst.dev/t/auth-stack-how-to-customize-cognito-password-policy/2711 "2022-07-25T10:14:02Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![bebu](https://avatars.discourse-cdn.com/v4/letter/b/a6a055/32.png) [@bebu](https://discourse.sst.dev/u/bebu)\
**Post date:** [July 25, 2022, 10:14am UTC](https://discourse.sst.dev/t/auth-stack-how-to-customize-cognito-password-policy/2711/1 "2022-07-25T10:14:02Z")

</div>

Hi to all,

I create my auth stack like this:

```auto
const auth = new Auth(stack, "Auth", {
  login: ["email"],
});

```

This sets the cognito password policy to “Cognito defaults” (8 characters minimum length, at least 1 number, 1 special character, …)

Is there a way to customize the password policy?

---

<div class="post-metadata">

**Author:** ![codenimble](https://yyz2.discourse-cdn.com/flex032/user_avatar/discourse.sst.dev/codenimble/32/1606_2.png) [@codenimble](https://discourse.sst.dev/u/codenimble)\
**Post date:** [May 10, 2025, 6:09am UTC](https://discourse.sst.dev/t/auth-stack-how-to-customize-cognito-password-policy/2711/2 "2025-05-10T06:09:05Z")

</div>

Yes, apparently it is different for v2 and v3. For v3:

```auto
export const userPool = new sst.aws.CognitoUserPool(
  "UserPool",
  {
    usernames: ["email"],
    verify: {
      emailSubject: "Verify your email for our app",
      emailMessage: "Hello {username}, your verification code is {####}",
    },
    transform: {
      userPool: (args, _opts) => {
        args.passwordPolicy = {
          minimumLength: 10,
          requireUppercase: false,
          requireSymbols: false,
          requireNumbers: false,
          requireLowercase: false,
          temporaryPasswordValidityDays: 7,
        }
      }
   }
}

```