# password_expiration_warning_threshold

> password_expiration_warning_threshold — Threshold for password expiration warnings. Observed in PG19 Beta 3; its last measured boot default is 7 d in PG19 Beta 3, with sighup context. This is a beta-snapshot fact and can change before PostgreSQL 19 GA.
---

> [!NOTE]
> **Fact — official short description:** “Threshold for password expiration warnings.”

## Identity {#identity}

| Field | Value | Meaning |
| --- | --- | --- |
| Type | `integer` | Upstream pg_settings type |
| Context | `sighup` | Takes effect after configuration reload |
| Unit | `s` | Raw unit |
| Range | `0` – `2147483647` | Raw limits in the last observed version |
| Enum values | — | — for non-enum types |
| Category | Connections and Authentication / Authentication | Upstream classification |
| Latest boot value | `604800` | 7 d |
{.fields meta="-"}

## Lifecycle {#lifecycle}

| Fact | Value |
| --- | --- |
| First observed | PG19 Beta 3 |
| Present in | PG19 Beta 3 |
| Removed in | No |
| Introduction commit | [`1d92e0c2cc47`](https://git.postgresql.org/gitweb/?p=postgresql.git;a=commit;h=1d92e0c2cc4789255c630d8776bbe85ca9ebc27f) — Add password expiration warnings. |
| Commit date | 2026-02-11 |
| Discussion | [thread 1](https://postgr.es/m/129bcfbf-47a6-e58a-190a-62fc21a17d03%40migops.com) |

## Default history {#default-history}

| Versions | Raw `boot_val` | Unit | Human value |
| --- | --- | --- | --- |
| PG19 Beta 3 | `604800` | `s` | 7 d |
{.full-width caption="Measured PG9.0–19 Beta 3 boot defaults"}

## How it works {#mechanism}

PostgreSQL describes password_expiration_warning_threshold as follows: “Threshold for password expiration warnings.” A configuration reload applies the value to the server without a full restart. The atlas measures it in PG19 Beta 3; boot_val is the compiled or initialized baseline, not proof of a running cluster's effective setting.

After successful password authentication, PostgreSQL warns when a role with VALID UNTIL has less than this interval remaining. Zero disables the warning; the default seven-day window is advisory and does not create, rotate, or extend credentials, and non-password authentication does not make password expiry management automatic.

Read it together with password_encryption, authentication_timeout, md5_password_warnings, hba_file. Check SHOW and pg_settings on the target server, verify the source and pending_restart fields, and compare workload, logs, and resource metrics before and after any change.

## Tuning advice {#tuning-advice}

> [!TIP]
> **Advice.** These are workload-specific starting points and must be validated with measurements.

| Workload | Guidance |
| --- | --- |
| OLTP | Roll out through staged clients, validate certificate selection and expiry warnings, and monitor authentication failures. Keep a tested fallback and treat file permissions and secret rotation as part of the same change. |
| OLAP | Apply the same security policy to batch drivers and long-lived ETL connections. Test clients that omit SNI, credential-expiry automation, reload behavior, and certificate-chain compatibility. |
| Small nodes | Prefer a simple, documented TLS and credential policy. Do not enable multi-certificate routing without a test for every hostname and fallback path, and never weaken verification to hide configuration mistakes. |
{.full-width}

## Pigsty {#pigsty}

Values use the fixed 8-vCPU, 32-GiB, 100-GiB SSD fixture and render the current Pigsty templates for PG19 Beta 3; this does not assert current Pigsty support for that historical or beta release.

| Template | Effective value | Versus upstream boot | Source expression |
| --- | --- | --- | --- |
| OLTP | Unmodified | — | — |
| OLAP | Unmodified | — | — |
| CRIT | Unmodified | — | — |
| TINY | Unmodified | — | — |
{.full-width}

> [!CAUTION]
> **Advice — pending human review.** Fact from the current Pigsty template projection: OLTP: PG19 Beta 3 unmodified; OLAP: PG19 Beta 3 unmodified; CRIT: PG19 Beta 3 unmodified; TINY: PG19 Beta 3 unmodified. No Pigsty-specific rationale is inferred from an absent override.

## Common pitfalls {#common-pitfalls}

- Treating the measured boot_val for password_expiration_warning_threshold as proof of the effective value on an initialized or managed cluster.
- Applying a change as though it were immediate while pg_settings reports sighup context.
- Changing this setting in isolation without checking the linked limits, observability, and rollback path.
- Depending on beta behavior in production without retesting the PostgreSQL 19 final release.

## Related parameters {#related-parameters}

[`password_encryption`](/parameters/password-encryption/) · [`authentication_timeout`](/parameters/authentication-timeout/) · [`md5_password_warnings`](/parameters/md5-password-warnings/) · [`hba_file`](/parameters/hba-file/)

## References {#references}

- [PostgreSQL 19 Beta 3 — password_expiration_warning_threshold](https://www.postgresql.org/docs/19/runtime-config-connection.html#GUC-PASSWORD-EXPIRATION-WARNING-THRESHOLD)
- [PostgreSQL 19 release notes](https://www.postgresql.org/docs/19/release-19.html)
- [Machine-readable GUC export](/data/guc.jsonl)