Password Policy Generator
Write a password policy that reflects current guidance, not 2005.
What you provide
Result
CHECK12 characters gives about 56 bits of entropy
The current guidance from both NIST and the UK NCSC points the same way: length matters, checking against known breached passwords matters, and forced complexity rules and periodic expiry make things worse rather than better. Expiry in particular pushes people to increment a digit, which is a pattern an attacker exploits rather than one it defeats. The one thing that outweighs everything on this page is not the policy at all. Adding a second factor blocks the credential-stuffing attacks that use passwords already known to be valid.
• At least 12 characters. Longer is better, and length beats complexity at every size. • Up to 128 characters accepted, with no restriction on which characters may be used. • Checked against a list of known breached and common passwords, and rejected if found. • No mandatory periodic expiry. Passwords are changed when there is a reason to believe one is compromised. • Spaces and pasting are allowed, so password managers work.
^(?=.*[a-z]).{12,128}$- Minimum length
- 12 characters
- Character classes required
- 1
- Effective alphabet
- 26 characters
- Entropy at the minimum
- 56 bits
- Offline cracking timeAt 100 billion guesses a second against a fast hash, which is what a leaked database faces
- 6 days
- Breached password check
- required
What this cannot tell you
- Everything is calculated in your browser from the settings you choose. No password is entered, generated or transmitted here.
- Entropy is computed from the alphabet your rules force into use, which assumes a password chosen at random from it. A human-chosen password that satisfies the same rules is usually far weaker, because people pick predictable patterns.
Take this with you
This tool never saves runs. What it handles should not be written to disk — not even your own.
How this calculation works
The entropy figure comes from the size of the alphabet your rules force into use, raised to the minimum length, which is the honest way to compare a long simple password against a short complex one. Cracking time is then estimated against a hundred billion guesses a second, the kind of rate a modern GPU cluster reaches against a fast hash, because that is the scenario that matters when a password database leaks. The policy text and a matching validation pattern are generated alongside.
What the results mean
- Entropy at the minimum
- Bits of randomness for a password chosen at random under these rules. Under 45 bits is weak against offline attack, 60 or more is a reasonable floor, and more is better.
- Offline cracking time
- How long the whole keyspace takes at a hundred billion guesses a second. Deliberately pessimistic, since it assumes a fast hash and a well-funded attacker.
- Character classes required
- How many types of character are mandatory. Requiring three or more at a short length is the combination that produces the most predictable passwords.
Common problems and fixes
- The policy is strict and users still pick weak passwords
- Complexity rules at a short minimum length produce a predictable shape: a capital at the front, a digit and a symbol at the end. Attackers model exactly that. Raise the minimum length to 12 or more, drop the class requirements, and check candidates against a list of known breached passwords, which removes far more weak choices than any pattern rule.
- Users write passwords down or reuse them everywhere
- That is usually the policy causing it. Forced expiry every 90 days, blocked pasting and low maximum lengths all push people towards reuse and towards writing things down. Allow long passphrases, allow pasting so password managers work, and drop scheduled expiry in favour of changing a password when there is a reason to.
Frequently asked questions
Should passwords expire every 90 days?
No, and both NIST and the UK NCSC now advise against it. Scheduled expiry pushes people to increment a digit on the end, which attackers anticipate, and it does nothing about a credential stolen the day after a change. Force a change when there is evidence of compromise instead.
Is a long passphrase better than a complex password?
Usually, yes. Four unrelated words are far easier to remember and can carry more entropy than a short string with a symbol in it. The key word is unrelated: a phrase from a song or a film is in every word list an attacker uses.
What matters more than the password policy?
A second factor, by some distance. Most successful account attacks use passwords already known to be valid from a breach elsewhere, and no policy protects against reuse. After that, storing passwords with a slow hash designed for the purpose, such as Argon2 or bcrypt, decides how much a leak actually costs you.
Put this on your own site
Free to embed, no attribution required beyond the source link the frame carries itself. It runs entirely in your visitor's browser, sets no cookies and loads no third-party script.
<iframe src="https://runthetests.com/embed/password-policy-generator/" width="100%" height="560" style="border:1px solid #e5e5e5;border-radius:8px" title="Password Policy Generator" loading="lazy"></iframe>
Preview it at https://runthetests.com/embed/password-policy-generator/. Embedded pages are marked noindex, so yours stays the canonical copy — not this one.