web-server/data/release/security/pwpolicy/default/config.xml

<passwordPolicy>
  <id>52857278:13c7ffd66a8:-7fff</id>
  <name>default</name>
  <className>org.geoserver.security.validation.PasswordValidatorImpl</className>
  <uppercaseRequired>false</uppercaseRequired>
  <lowercaseRequired>false</lowercaseRequired>
  <digitRequired>false</digitRequired>
  <minLength>0</minLength>
  <maxLength>-1</maxLength>
</passwordPolicy>