The Grafana user interface enforces the password security settings described in this section.
Grafana interface password policy
The Grafana user interface applies the following session and failed-login protections.
Setting | Value |
|---|---|
Maximum inactive session lifetime | 10 minutes |
Failed attempts before lockout | 5 |
Initial lockout duration | 5 minutes |
Backoff strategy | Exponential (doubles with each subsequent batch of failures) |
Permanent lockout | No |
Grafana interface password storage
Grafana never stores passwords in plaintext. A cryptographic key derivation function produces a hash that is stored instead of the original password.
Setting | Value |
|---|---|
Algorithm | PBKDF2 with HMAC-SHA256 |
Iterations | 10,000 |
Salt size | 10 bytes (random per user) |