PostgreSQL: credcheck v4.1 has been released

[NewsBot]

A new PostgreSQL blog post/announcement has been posted!

Durban, South Africa - October 19, 2025

PostgreSQL credcheck extension

The credcheck PostgreSQL extension provides few general credential checks, which will be evaluated during the user creation, during the password change and user renaming. By using this extension, we can define a set of rules:

• allow a specific set of credentials
• reject a certain type of credentials
• deny password that can be easily cracked
• enforce use of an expiration date with a minimum of day for a password
• define a password reuse policy
• define the number of authentication failure allowed before a user is banned
• define a delay on authentication failures
• force users to change their password after first login
• throw a warning N days before when the password user is about to expire

Release 4.1 has been published, it includes the following new features:

• At user creation and password change, credcheck automatically set the VALID UNTIL clause to now() + credcheck.password_valid_until days when it is present in the statement.
• Extend the functionality of 'username_contain' and 'username_not_contain' GUCs to allow users to use sub-strings instead of single characters only.
• Add feature to send a warning to the user N days before his password expires. The number of days before can be set using the credcheck.password_valid_warning setting. It is disabled by default. This is done using an event trigger up on login. The point is that the trigger must be set manually in all databases where you want enable this feature.
• Change the pg_banned_role view to display the rolename instead of the role oid.
• No more error are thrown when no VALID UNTIL clause are used in the CREATE/ALTER ROLE statements. It is set automatically when configuration directive password_valid_until is set to a value greater than 0.</...

Get the full details here: PostgreSQL: credcheck v4.1 has been released