I'm currently trying to make my website PCI DSS compliant and one of the requirements is to ensure that, when an administrator user selects a new password, it cannot be the same as any of the last four password that they have used.

Is there a way to set the number of stored passwords in Magento 2.2.7 so that it will not allow an admin user to use a password they have used previously?

2 Answers 2


I don't think Magento default has this feature to store the password history for frontend customer. Only it has for the admin user password change history.

First, you want then create a custom table with

And save and validate customer password at

Magento\Customer\Model\Customer\Attribute\Backend\Password class.

  • Thanks, I'm only really looking for the Admin password history anyway. Changing the customer password history is not necessary.
    – CJNotts
    Jun 3, 2019 at 8:07
  • That class is responsible for saving the password. So you want custom module and save password old password then you have work on this class.
    – Amit Bera
    Jun 3, 2019 at 8:10
  • I may be misunderstanding this but The class you've specified here seems to be for the customer password. I only need to save the last 4 instances of the Admin password. The customer ones are fine.
    – CJNotts
    Jun 3, 2019 at 8:25

I'm answering late sorry, but it may be helpful for others. Magento has out of box feature to not allow any previously used passwords for admin users. Magento stores used passwords in table "admin_passwords" so you can find admin users all password history in it. screenshot: enter image description here

So for backend users this feature is already available with Magento2. You can test it by edit user and try to update password with used passwords.

Thank you.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.