Manual:$wgPasswordPolicy/en

Details
A password policy is of the form


 * etc. are user groups, plus the special group  which is required to be present and applies to everyone.
 * etc. are arbitrary check names, defined in the  subarray. If the same check applies to a user via multiple groups, it will be applied with the   of the values.
 * etc. are PHP callables, which receive three arguments: the defined value, the object and the password, and return a StatusValue. A fatal status means the password can't be used, even for login; a non-fatal error means the value is not accepted as a new password (on account creation or password change), but can be used for login; the user will be shown a (skippable) password change form. Default checks (found in  ):
 * - Minimum length a user can set
 * - Passwords shorter than this will not be allowed to login, regardless if it is correct.
 * - Maximum length password a user is allowed to attempt. Prevents DoS attacks with pbkdf2.
 * - Password cannot match username
 * - Username/password combination cannot match a specific, hardcoded blacklist.
 * - Blacklist passwords which are known to be commonly chosen. Set to integer n to ban the top n passwords. If you want to ban all common passwords on file, use the  constant.

Examples
This example shows how to change selected policies for all users:

This example shows how to change selected policies for users of the "sysop" group: