Password Policy Generator
Answer a few questions about your requirements and get a clear, written password policy you can share with your team or paste into documentation.
Why These Defaults
Length Over Complexity
NIST SP 800-63B prioritises minimum length (8+, ideally 12-16+) over mandatory character-class rules, since length contributes more to real-world resistance against cracking than forced symbol requirements.
Breach Screening Over Rotation
Checking new passwords against known-breached password lists catches genuinely weak choices. Mandatory periodic rotation, by contrast, tends to produce predictable variations of old passwords and is no longer broadly recommended.
Lockout Over Unlimited Attempts
A reasonable failed-attempt lockout (e.g. 10 attempts) makes offline-style brute-forcing against the live login form impractical, independent of password strength.
Frequently Asked Questions
Current NIST SP 800-63B guidance recommends against mandatory periodic rotation for user accounts — it tends to produce weaker, more predictable passwords. Prefer breach-triggered resets and a solid minimum length instead.
NIST recommends a minimum of 8 and encourages supporting up to 64+ characters. Many organisations set a practical minimum of 12-16 for standard accounts, with longer minimums or passphrases for privileged accounts.
It's optional. Length contributes more to entropy than character-class rules, and current guidance increasingly favors longer minimums plus breach screening over mandatory symbol requirements.