Password policy generator

This tool helps you write a consistent password policy from three presets and about ten settings. It is for administrators, security officers and developers who need to document or implement rules, and it produces a readable summary plus a JSON configuration.

The current reference is NIST SP 800-63B-4, published in July 2025: at least 15 characters when a password is the only authentication factor, 8 when a second factor is required, support for at least 64 characters, no character-class composition rules and no routine periodic changes. It also requires rejecting common, compromised or context-specific passwords and limiting consecutive failed attempts to no more than 100. The presets now follow those principles: Balanced uses 15 characters with no composition rule, no forced expiration and a 10-attempt threshold; Strict raises the minimum to 20 characters and uses a 5-attempt threshold; Passphrase uses 24 characters with no composition rule. Password history remains available for organisations that need it, but it is not treated as a NIST requirement.

Inputs are clamped to the tool limits: minimum length 6 to 128, history 0 to 50, expiration 0 to 3,650 days and failed-attempt threshold 0 to 100. The estimated level is an indicative score, not a NIST compliance certificate: it rewards a 15-character minimum, adds credit at 20 characters, rewards blocking common passwords, blocking obvious personal data, leaving periodic expiration disabled, configuring an attempt limit and allowing passphrases. Character-class requirements lower the score because NIST explicitly prohibits them, while password history is neutral. Warnings appear for any forced expiration, a minimum below 15 characters, composition requirements or a missing common-password blocklist.