diff --git a/lib/devise.rb b/lib/devise.rb
index 3847e190c..e107724c0 100644
--- a/lib/devise.rb
+++ b/lib/devise.rb
@@ -119,7 +119,7 @@ module Test
 
   # Range validation for password length
   mattr_accessor :password_length
-  @@password_length = 6..128
+  @@password_length = 12..128
 
   # The time the user will be remembered without asking for credentials again.
   mattr_accessor :remember_for
diff --git a/lib/generators/templates/devise.rb b/lib/generators/templates/devise.rb
index 9e6744bd7..a0eaf2c87 100644
--- a/lib/generators/templates/devise.rb
+++ b/lib/generators/templates/devise.rb
@@ -178,7 +178,7 @@
 
   # ==> Configuration for :validatable
   # Range for password length.
-  config.password_length = 6..128
+  config.password_length = 12..128
 
   # Email regex used to validate email formats. It simply asserts that
   # one (and only one) @ exists in the given string. This is mainly