Maximum invalid login attempts, password complexity requirements, and number of days until expiration are three password policies that an administrator can configure to encourage employees to choose secure and appropriate passwords for their Salesforce accounts. Maximum invalid login attempts determines how many times a user can enter an incorrect password before being locked out of Salesforce. Password complexity requirements determine how complex a user's password must be based on criteria such as length,case sensitivity, alphanumeric characters, etc. Number of days until expiration determines how often users must change their passwords.References:https://help.salesforce.com/s/articleView?id=sf.
security_password_policies.htm&type=5