The Password Policy Generator turns a few choices into a complete, consistent password policy — expressed both as plain-English rules for your documentation and as a JSON config your authentication system can consume. It is useful for security teams writing an internal standard or engineers wiring up a sign-up form.
How it works
You start from a preset (Basic, Standard, or Strict) or build a custom policy. Each policy captures the settings real auth systems enforce:
- Length — a minimum and maximum character count.
- Character classes — independent toggles for lowercase, uppercase, number, and symbol requirements.
- History and expiry — how many previous passwords are blocked from reuse, and whether passwords expire after a set number of days.
- Lockout — how many failed attempts trigger a lock and for how long.
The tool then renders a bulleted human-readable summary and the equivalent JSON, keeping the two views perfectly in sync as you adjust any field.
Tips and notes
- The required-character-class counter shows how many of the four classes are enforced, a quick proxy for complexity.
- Following NIST SP 800-63B, favour a longer minimum length and breached-password screening over piling on symbol requirements.
- Set expiry to 0 to disable scheduled password rotation, which modern guidance recommends unless a compromise is suspected.
- Both outputs copy with one click, so you can drop the text into a policy doc and the JSON straight into your auth configuration.