Password Policy Generator & Checker

About the Password Policy Generator & Checker

Many password policies still demand a capital letter, a digit and a symbol, and a new password every 90 days. NIST’s current guidance, SP 800-63B-4, says the opposite: make passwords long (at least 15 characters when a password is used on its own, 8 when another factor is always used too), let systems accept at least 64, screen every new password against a blocklist of breached and predictable passwords, and impose no composition rules and no periodic changes — only a change when there is evidence of compromise. Password managers and pasting are allowed, hints and security questions are not, and failed attempts are limited to at most 100.

Choose NIST’s values or a stricter internal rule, say how passwords are used, and this generator writes the policy document (with a Premium pass, copy it or download Word, Markdown or text) and the settings that enforce it: an Active Directory fine-grained password policy in PowerShell, pam_pwquality and pam_faillock files for Linux, and JSON for developers. Paste your current policy under Check your current policy to see, sentence by sentence, where it differs from the guidance.

Without a pass you see a free preview: the policy’s pages with your details and the first part of the wording, marked as a preview, the first lines of each settings file and the first findings of the policy check. The full policy, the settings and the downloads unlock with a Premium pass.

Common uses

• Replacing an old password policy (complexity rules and 90-day expiry) with current guidance.
• Writing the password section of an information security policy or an audit response.
• Configuring Active Directory or Linux servers to match the written policy.
• Giving developers the exact rules for a sign-up form.
• Reviewing a supplier’s or a client’s password policy against NIST’s guidance.

What SP 800-63B-4 requires

• Length: at least 15 characters for passwords used as a single factor, at least 8 for passwords used only with another factor; systems SHOULD accept at least 64. All printable ASCII characters, the space and Unicode SHOULD be accepted, each code point counting as one character, normalised with NFC (§3.1.1.2).
• No composition rules (SHALL NOT) and no periodic changes (SHALL NOT), but a forced change when there is evidence of compromise (SHALL).
• Blocklist (SHALL): the whole new password is compared with known, expected or compromised values — earlier breaches, dictionary words, the service name, the user name — refused with the reason, and guidance is offered.
• Entering passwords: password managers and autofill SHALL be allowed, pasting SHOULD be, and an option to show the password SHOULD be offered; no hints readable before sign-in, no knowledge-based questions, no truncation.
• Failed attempts: no more than 100 consecutive failures per account, by disabling the password (§3.2.2); bot checks, growing delays and risk checks may be added.
• Storage: salted (at least 32 bits) and hashed with a password hashing scheme resistant to offline attacks, cost as high as practical.

The publication page has the complete document.

The Active Directory settings

The PowerShell creates a fine-grained password policy (a Password Settings Object) with New-ADFineGrainedPasswordPolicy and applies it to a group. A PSO accepts a minimum length of 0 to 255 (schema), while the classic Group Policy setting accepts 0 to 14 (Microsoft Learn). Expiry is switched off — and with Disabled until reset, a locked account stays locked until an administrator unlocks it — with the value Microsoft documents for “never” (-9223372036854775808; PSO attribute constraints)), set after the policy is created, because the observation window may not be longer than the lockout duration. Turning complexity off also removes Windows’ check for the account name in the password, and Active Directory has no blocklist of its own, so add a password filter that screens against one on every domain controller.

The Linux settings

• pam_pwquality (pwquality.conf(5)): minlen with every credit at 0 is a plain minimum length; minclass, maxrepeat and maxsequence at 0 mean no composition rules; dictcheck, usercheck, gecoscheck and badwords screen against the cracklib dictionary, the user name, the account’s full name and your own words.
• pam_faillock (faillock.conf(5)): deny is the limit; unlock_time = 0 keeps an account locked until it is reset.
• Expiry: PASS_MAX_DAYS in login.defs applies to new accounts; chage -M -1 removes the maximum age from an existing one.

How the policy check works

The text is split into sentences and rules — at full stops, semicolons, bullets and line breaks, with Markdown and wiki formatting ignored — and each is read for the topics above: lengths (in digits or words), composition terms, expiry periods, blocklists, hints, security questions, paste, lockout numbers, truncation and storage. A requirement and its negation are told apart where they stand (“must contain a digit” is a gap; “digits are not required” and “no upper-case letters, digits or symbols are required” are not), and numbers next to “with MFA” count as the minimum for passwords used with another factor. A lockout that lifts by itself after some minutes is marked for checking, because SP 800-63B-4 asks for the password to stop working after at most 100 consecutive failures. Every finding quotes its sentence, so check it before you act: the reading is careful, but a policy can phrase things in ways no pattern foresees.

Limitations

• This is a template based on NIST SP 800-63B-4; other rules may apply to you (a regulator, a contract, a payment-card standard). Have it reviewed before you adopt it.
• A fine-grained password policy has one minimum length: give accounts that always use another factor their own policy if their minimum differs.
• Neither Active Directory nor pam_pwquality checks breached-password lists out of the box: the policy requires it, and the settings name what to add.
• The policy check reads English text, quotes what it bases each finding on, and can miss unusual wording.

Privacy

On this device; its files download once

The policy, the settings and the check are made in your browser; nothing you type or paste is uploaded. Your choices, including the organisation name, are remembered in this browser only so the policy is the same next time — Reset clears them.