OneTaskBy Tim King · Updated
Password Policy Generator
NIST Password Guidelines in a Company Policy, With MFA-Aware Length Rules
OneTask is free, with no sign-up, and built by one person.
If this tool saved you time, a coffee helps keep new ones coming.
How the Password Policy Generator works
This password policy generator writes a policy for staff, customer or admin accounts that follows current NIST guidance. Enter your organisation's name, choose who it covers and whether multi-factor login is required, and copy a complete policy in plain text or Markdown.
What goes into the password policy generator's output
Older policies demanded a capital, a number and a symbol and forced a change every 90 days. NIST SP 800-63B dropped both rules, because they push people towards predictable passwords like Summer2026!. The current guidance favours length, blocks known breached and common passwords, and asks for a change only when there is evidence of compromise.
The minimum length follows the latest NIST revision. When a password is the only factor, it must be at least 15 characters. When multi-factor login is also required, 8 is the floor. Admin and privileged accounts always get 15. Every policy allows at least 64 characters, spaces and any printable character, and requires paste and password managers to work.
The policy also covers blocklist screening, rate limiting of failed logins, secure storage with a slow hashing function such as Argon2id, and reset rules. Staff and admin versions add sections on sharing, reuse and what to do if a password is exposed. Adapt the wording to your own systems before publishing.
FAQ
Why no complexity rules?
Composition rules make passwords harder to remember but barely harder to crack, because people follow the same patterns. Length and a check against breached passwords give far more protection for users.
Should passwords expire every 90 days?
No. Forced expiry leads to small predictable changes such as adding 1 to the end. NIST advises changing a password only when there is a sign it was compromised, such as a breach or suspicious login.
Why is the minimum 15 characters without multi-factor login?
The 2025 revision of NIST SP 800-63B sets 15 as the minimum when a password is the only factor, and 8 when it is used with another factor. A longer passphrase makes guessing attacks far slower.
Can I use this policy as it is?
It is a solid starting point, but check it against your systems, contracts and any sector rules you follow, such as PCI DSS, and have it approved by whoever owns security policy in your organisation.
See also: all Security & Identifiers tools, Dev Utilities, Formatters & Validators, Data & Encoding, SEO, Accessibility, AI.
Related tools
Password Policy Tester
Test a list of passwords against length, character and banned-word rules.
Password Strength Checker
Estimate a password's entropy, crack time and weak patterns.
Pwned Password Checker
Check a password against breach data without sending the password.
Account Security Checklist
A prioritised checklist to secure email, bank, social and work accounts.
OWASP Top 10 Reference
The OWASP Top 10 web risks with plain explanations and fixes.