Technical Tip: How to update a password with a space on it with new password also with a space

Note: 

FortiOS v7.6.6 normalizes passwords during input to prevent formatting or parsing errors. This means any leading or trailing spaces are automatically stripped, so a password starting with a space character will not be accepted. This behavior is consistent across both GUI and CLI configuration methods. The security model enforces this rule to prevent authentication mismatches or hidden character issues.

Why are leading spaces not allowed:

FortiOS v7.6.6 normalizes passwords during input to prevent formatting or parsing errors. This means any leading or trailing spaces are automatically stripped, so a password starting with a space character will not be accepted. This behavior is consistent across both GUI and CLI configuration methods. The security model enforces this rule to prevent authentication mismatches or hidden character issues.

Enforced Password Policy in FortiOS v7.6.6.

When creating or modifying an admin password:

Minimum length: 12 characters.

Must include:

• 1 lowercase letter.
• 1 uppercase letter.
• 1 number (0–9).
• 1 special (non‑alphanumeric) character.

The global policy applies to all administrator accounts by default. Logging in with a password that does not meet these requirements will prompt for a new one.

How to Verify or Adjust Password Policy via CLI:

FortiGate password policy can be verified with:

show system password-policy

To enforce a custom policy:

config system password-policy
    set apply-to admin-password
    set status enable
    set minimum-length 12
    set min-lower-case-letter 1
    set min-upper-case-letter 1

    set min-number 1
    set min-non-alphanumeric 1

end

Facts:

•  Many people use different kinds and lengths of passwords with or without spaces, special characters, etc.
•  It is common that a user customizes passwords, but not commonly used to have a space in it.
•  All the above steps will not work for updating a password with a space in it.
•  If a password change is needed for a super-admin user, but a space in the password is desired, FortiGate will not allow this change via GUI or CLI.

Solution:

1. It is necessary to force the user to change the password during the next login.
                                                                       
   

    

2. User needs to log in with the old password and apply the new password with a space included in it.

3. The user will be prompted to change the password by using the old and new passwords twice.

4. Once the new password with a space included is accepted, the user will be able to log in with the new password.