Skip to content
English
MLS / Association Staff Login
  • There are no suggestions because the search field is empty.

New Minimum Password Requirements

Solid Earth is raising the minimum password requirements to better protect your account.

Important: This update does not require existing users to change their current password. New requirements apply only when a password is created for the first time or changed.

This update goes into effect Tuesday, September 22, 2026 at 5:00 PM CT (6:00 PM ET).

Who is impacted

Scenario Must meet new requirements?
Existing user — no password change No impact
New user creating an account Yes
Existing user changing their password Yes

New password requirements

  1. Minimum Length — Password must be at least 12 characters long.
  2. Complexity — Must include at least 1 uppercase letter (A–Z), 1 lowercase letter (a–z), and 1 number (0–9). Special characters are not required.
  3. No Profile-Based Information — Password cannot contain 5 or more consecutive characters from the user's email address, first/last name, full name, MLS IDs, or related member login IDs.
  4. No Obvious Sequences — Common sequential patterns are not allowed, for example: 123456 or abcdef.
  5. Leaked Password Protection — Passwords are checked against known compromised credential databases. A password with 2 or more known leak events will be blocked to protect your account. This check is powered by Cloudflare's Leaked Credentials Check, which compares submitted passwords against Have I Been Pwned's breach dataset and Cloudflare's own collected leak data, using hashed comparisons so plaintext passwords are never stored or transmitted.

Validation & user feedback

If a password does not meet the requirements, the system will return all failed rules at once, so users can see and correct everything in a single step rather than encountering errors one at a time.

What users will see

Requirements are listed up front wherever a password is set or changed (new account setup, Account & Password Settings, and sign-in helper text):

  • Is at least 12 characters long
  • Includes at least one uppercase letter, one lowercase letter, and one number
  • Doesn't contain parts of your name, email, or MLS ID
  • Doesn't include simple sequences like "123456" or "abcdef"
  • (When changing an existing password) Isn't the same as your current password

If a password falls short, every unmet rule is listed together, for example:

  • "The password field must be at least 12 characters"
  • "The password field must include at least one uppercase letter"
  • "The password field must include at least one lowercase letter"
  • "The password field must include at least one number"
  • "The password field cannot include parts of your name, email, or MLS ID"

Frequently Asked Questions

Will users be forced to reset their current password?
No. Existing users are not required to update their password. The new rules only apply when a password is created or changed.

Are special characters required?
No. Special characters are not required, though they may be used.

What happens if a password is flagged as leaked?
Passwords with 2 or more known leak events are blocked. Users will be prompted to choose a different password. (How this check works →)

Will users see all rejection reasons at once?
Yes. All failed rules are returned together so users can correct everything in one go.

When does this take effect?
Tuesday, September 22, 2026 at 5:00 PM CT (6:00 PM ET).