Password policy generator
Draft a password policy that follows current NIST guidance, tailored to your organisation’s size, MFA set-up and compliance needs. Start from the checklist, then let the writer turn it into a policy document.
NIST SP 800-63B at a glance
| Minimum length | 15 characters for single-factor; 8 when MFA is in place |
|---|---|
| Maximum length | Allow at least 64 characters |
| Characters | Accept all printable ASCII, spaces and Unicode |
| Composition rules | Don’t require mixtures of character types |
| Expiry | No periodic changes; force a change on evidence of compromise |
| Blocklist | Screen against breached, common and context-specific passwords |
| Hints & security questions | Not allowed |
| Paste & password managers | Allow paste and autofill |
| Failed attempts | Rate-limit; lock out after at most 100 consecutive failures |
| Storage | Salted, slow hash: Argon2id, scrypt, bcrypt or PBKDF2 |
Fill in the form and press “Write my policy” for a full draft based on these rules.
What changed in password policy, and why
For years, corporate policy meant eight characters, one uppercase, one number, one symbol, changed every 90 days. NIST’s Special Publication 800-63B dropped almost all of that, first in 2017 and more firmly in revision 4. The research it cites found that composition rules and forced expiry push people into predictable patterns and reuse, while doing little against real attacks.
What works instead is length, a check against known-breached passwords, multi-factor authentication, and letting people use password managers. The UK’s National Cyber Security Centre gives the same advice in its password guidance for system owners.
Supporting a policy with tools
- Issue temporary credentials with the bulk password generator.
- Teach staff to make memorable master passwords with the passphrase generator.
- Show people why “P@ssw0rd!” fails with the password strength checker.
Questions people ask
What are the current NIST password guidelines?
NIST SP 800-63B (revision 4, 2025) says: require at least 15 characters when a password is the only factor, or 8 with multi-factor authentication; allow at least 64 characters and any characters including spaces and Unicode; do not impose composition rules like “one uppercase, one symbol”; do not force periodic changes; check new passwords against lists of breached and common passwords; and allow paste and password managers.
Should a password policy require special characters?
No, according to NIST. Composition rules make passwords harder to remember without making them much harder to crack, because people satisfy them in predictable ways such as a capital first letter and “!” at the end. A length minimum plus a breached-password check does more.
How often should employees change passwords?
Only when there is evidence of compromise. NIST removed routine expiry because it led to predictable changes like Password1 → Password2. Some compliance frameworks and cyber insurers still ask for rotation; check yours, and document the NIST rationale if you drop it.
Does the AI see my passwords?
No. The policy writer only receives the organisation details you type in the form (name, size, MFA, SSO, compliance, notes). No passwords are involved, and nothing is stored after the response is written.
Can I use the generated policy as-is?
Treat it as a solid first draft. Review it against your own systems and any contractual or regulatory requirements, and have whoever owns security sign it off.