Password Policy Generator

Write a password policy that reflects current guidance, not 2005.

What you provide

Result

CHECK

12 characters gives about 56 bits of entropy

The current guidance from both NIST and the UK NCSC points the same way: length matters, checking against known breached passwords matters, and forced complexity rules and periodic expiry make things worse rather than better. Expiry in particular pushes people to increment a digit, which is a pattern an attacker exploits rather than one it defeats. The one thing that outweighs everything on this page is not the policy at all. Adding a second factor blocks the credential-stuffing attacks that use passwords already known to be valid.

Policy text
• At least 12 characters. Longer is better, and length beats complexity at every size.
• Up to 128 characters accepted, with no restriction on which characters may be used.
• Checked against a list of known breached and common passwords, and rejected if found.
• No mandatory periodic expiry. Passwords are changed when there is a reason to believe one is compromised.
• Spaces and pasting are allowed, so password managers work.
Validation pattern
^(?=.*[a-z]).{12,128}$
Diagnostic telemetry
Minimum length
12 characters
Character classes required
1
Effective alphabet
26 characters
Entropy at the minimum
56 bits
Offline cracking timeAt 100 billion guesses a second against a fast hash, which is what a leaked database faces
6 days
Breached password check
required

What this cannot tell you

  • Everything is calculated in your browser from the settings you choose. No password is entered, generated or transmitted here.
  • Entropy is computed from the alphabet your rules force into use, which assumes a password chosen at random from it. A human-chosen password that satisfies the same rules is usually far weaker, because people pick predictable patterns.

Take this with you

This tool never saves runs. What it handles should not be written to disk — not even your own.

Password Policy Generator on RunTheTests — free browser-based websec tools, no sign-up.