Build a modern password policy checklist

This generates product/security requirements, not legal or compliance certification. The defaults emphasize current length, blocklist, paste/autofill, and compromise-driven rotation guidance.

Minimum length

Maximum accepted length

Authentication context

NIST guidance for centrally verified passwords rejects arbitrary composition rules and routine expiration, while emphasizing sufficient length and blocking commonly used or compromised values. Adapt any policy to your actual authentication system and risk model.

Modern password guidance without false certainty

v10.77 keeps password/passphrase generation and review browser-local while shifting guidance toward length, uniqueness, common-password blocking, password-manager compatibility, MFA, and compromise-driven changes rather than arbitrary composition rules or guaranteed crack-time claims.

Security boundary

A local meter can flag obvious patterns but cannot prove that a password is safe, unused elsewhere, or absent from every breach corpus. Do not paste sensitive production password exports into batch tools; generate unique secrets locally and store them in an appropriate password manager.

How to use this Password Policy Builder

Build a practical modern password policy checklist from length, MFA, blocklist, paste/autofill, and rotation choices without relying on obsolete composition-rule folklore.

Enter, paste, upload, or choose the inputs shown in the tool above.
Adjust the available options for the result you need.
Review the output before copying, downloading, or using it elsewhere.

What this tool does

Choose a deployment context and generate a copy-ready browser-local password policy checklist with explicit NIST/OWASP-oriented boundaries.

Practical tips and limits

Review the inputs and result before using the output elsewhere. Keep the original data when the operation changes or replaces content.