All passwords are stored in an encrypted format; passwords expire once a month; the maximum number of failed attempts is 5 but it can be configured.