diff --git a/backend/config.py b/backend/config.py
index 85b33ff..5455b6d 100644
--- a/backend/config.py
+++ b/backend/config.py
@@ -158,8 +158,8 @@ def validate_production_security() -> None:
             or JWT_SECRET.startswith("replace-") or len(JWT_SECRET) < 32):
         errors.append("JWT_SECRET 必须设置为至少 32 位的随机字符串")
     if (ADMIN_PASSWORD == "admin123" or ADMIN_PASSWORD.startswith("change-")
-            or len(ADMIN_PASSWORD) < 12):
-        errors.append("ADMIN_PASSWORD 必须设置为至少 12 位的强密码")
+            or len(ADMIN_PASSWORD) < 11):
+        errors.append("ADMIN_PASSWORD 必须设置为至少 11 位的强密码")
     if not CORS_ALLOWED_ORIGINS or "*" in CORS_ALLOWED_ORIGINS:
         errors.append("CORS_ALLOWED_ORIGINS 必须设置为实际 HTTPS 前端域名，且不能为 *")
     if not os.getenv("TRUSTED_HOSTS") or "*" in TRUSTED_HOSTS:
diff --git a/backend/routers/users.py b/backend/routers/users.py
index 84302f2..1af7ea5 100644
--- a/backend/routers/users.py
+++ b/backend/routers/users.py
@@ -35,8 +35,8 @@ async def create_user(data: dict, user: dict = Depends(get_current_user), db: Se
 
     if not username or not password:
         raise HTTPException(status_code=400, detail="用户名和密码不能为空")
-    if len(password) < 12:
-        raise HTTPException(status_code=400, detail="密码至少 12 位")
+    if len(password) < 11:
+        raise HTTPException(status_code=400, detail="密码至少 11 位")
     if db.query(User).filter(User.username == username).first():
         raise HTTPException(status_code=400, detail="用户名已存在")
 
@@ -61,8 +61,8 @@ async def change_password(user_id: str, data: dict, user: dict = Depends(get_cur
         raise HTTPException(status_code=404, detail="用户不存在")
 
     new_password = data.get("password", "").strip()
-    if not new_password or len(new_password) < 12:
-        raise HTTPException(status_code=400, detail="密码至少 12 位")
+    if not new_password or len(new_password) < 11:
+        raise HTTPException(status_code=400, detail="密码至少 11 位")
 
     target.password_hash = hash_password(new_password)
     db.commit()
diff --git a/frontend/src/views/ConfigView.vue b/frontend/src/views/ConfigView.vue
index bf41191..13816f2 100644
--- a/frontend/src/views/ConfigView.vue
+++ b/frontend/src/views/ConfigView.vue
@@ -325,7 +325,7 @@
         </div>
         <div class="form-group">
           <label>密码 *</label>
-          <input v-model="userForm.password" type="password" placeholder="至少 12 位">
+          <input v-model="userForm.password" type="password" placeholder="至少 11 位">
         </div>
         <div class="form-group">
           <label class="checkbox-label">
@@ -349,7 +349,7 @@
         </div>
         <div class="form-group">
           <label>新密码</label>
-          <input v-model="newPassword" type="password" placeholder="至少 12 位">
+          <input v-model="newPassword" type="password" placeholder="至少 11 位">
         </div>
         <div style="margin-top: 20px; display: flex; gap: 12px; justify-content: flex-end;">
           <button class="action-btn" style="padding: 8px 16px;" @click="showPasswordModal = false">取消</button>
@@ -650,8 +650,8 @@ const createUser = async () => {
     alert('请填写用户名和密码')
     return
   }
-  if (userForm.value.password.length < 12) {
-    alert('密码至少 12 位')
+  if (userForm.value.password.length < 11) {
+    alert('密码至少 11 位')
     return
   }
   try {
@@ -678,8 +678,8 @@ const openPasswordModal = (u) => {
 }
 
 const changePassword = async () => {
-  if (!newPassword.value || newPassword.value.length < 12) {
-    alert('密码至少 12 位')
+  if (!newPassword.value || newPassword.value.length < 11) {
+    alert('密码至少 11 位')
     return
   }
   try {