Password Policy Generator

Create and visualize password policy requirements. Generate example passwords that comply with your policy.

Privacy: This tool runs locally in your browser. No data is stored or transmitted.

Policy Requirements

Password Policy Summary

Your password must meet the following requirements:

  • Minimum length: 15 characters
  • Maximum length: 128 characters (spaces and Unicode allowed)
  • Must not appear in a list of breached or commonly used passwords
  • No forced periodic changes; reset only on evidence of compromise

✓ This policy is consistent with NIST SP 800-63B-4.

About Password Policies

Password policies define the requirements that passwords must meet to ensure security. A well-designed policy balances security with usability.

Best practices for password policies

  • Minimum length: NIST SP 800-63B-4 requires at least 15 characters when the password is the only factor, and at least 8 when it is combined with MFA
  • Blocklist, not composition rules: Reject passwords found in breach corpuses and common-password lists instead of mandating a mix of character types
  • Accept everything: Allow spaces, all printable characters, and Unicode so passphrases and password-manager output work
  • Maximum length: Permit at least 64 characters, and never silently truncate
  • Rate-limit login attempts: Throttling is what makes shorter passwords survivable against online guessing

Common policy mistakes

  • Requiring frequent password changes (users make weaker passwords)
  • Too many character requirements leading to predictable patterns
  • Not allowing password managers (blocking special characters)
  • Maximum length limits that are too short

Frequently Asked Questions

What's the best minimum password length?

NIST's 2025 revision of SP 800-63B sets 15 characters for single-factor passwords and 8 when the password is one factor of MFA. Many organizations use 12–14 as a compromise; longer is always better.

Should I require all character types?

Current NIST guidance says verifiers should not impose composition rules. In practice they push users toward predictable patterns like Password1!. Use length plus a blocklist instead. Our NIST password guidelines guide explains each rule.

How often should passwords be changed?

Modern guidance suggests only changing passwords when there's evidence of compromise. Forced periodic changes often result in weaker passwords.

Should I allow password managers?

Absolutely! Password managers are one of the best security tools. Make sure your policy doesn't block them by allowing special characters and long passwords.

Learn more