What this generates
Pick the settings for a password policy — minimum/maximum length, rotation, MFA, breach checking, and more — and get a copyable policy document, plus a live check of each setting against NIST SP 800-63B (Digital Identity Guidelines — Authentication and Lifecycle Management), the current authoritative standard for memorized-secret policy.
Why NIST 800-63B is the reference point
800-63B is worth knowing specifically because it reverses a lot of older conventional wisdom that's still baked into plenty of real systems:
- No mandatory periodic rotation. Verifiers should not force a password change on a fixed schedule — only when there's actual evidence of compromise. Forced rotation tends to produce predictable, related passwords (
Summer2024!→Fall2024!) rather than meaningfully stronger ones. - No mandatory composition rules. Requiring a mix of uppercase, lowercase, digits, and symbols pushes users toward predictable patterns — a capital first letter, a symbol at the end — without meaningfully increasing real entropy.
- A hard minimum of 8 characters, with support for at least 64 — and more recent guidance recommending 15+ when a password is the only authentication factor in use.
- Required breach-checking — new passwords must be checked against a corpus of known-compromised and commonly-used passwords, and rejected on a match. The standard real-world mechanism for this is a k-anonymity range query, as used by Have I Been Pwned's Pwned Passwords service: only the first five characters of the password's SHA-1 hash are sent, the service returns every matching hash suffix, and the actual comparison happens locally — the real password is never transmitted or logged.
- Paste must be allowed into password fields — blocking it discourages password manager use, which produces weaker passwords overall.
Try it yourself
Password Generator creates passwords that satisfy whatever policy you land on here, and Password Entropy Calculator checks a specific password against common weak patterns and estimates its crack time.
FAQ
Does this policy get enforced anywhere automatically?
No — this generates a policy document to adopt and implement in whatever system actually authenticates users (an identity provider, an application's own auth code, an LDAP/AD configuration). It doesn't configure anything for you.
Why does the tool recommend against rules my compliance framework requires?
Some frameworks (older PCI-DSS versions, for instance) still mandate periodic rotation or composition rules that predate NIST's current guidance. Where a specific compliance requirement conflicts with 800-63B, the compliance requirement is what you legally have to satisfy — the alignment check here is describing security best practice, not telling you which one wins in a specific regulatory context.
Is anything I enter here sent anywhere?
No — the policy is generated and evaluated entirely in your browser.