Password Policy Builder

Choose a deployment context and generate a copy-ready browser-local password policy checklist with explicit NIST/OWASP-oriented boundaries.

Build a modern password policy checklist

This generates product/security requirements, not legal or compliance certification. The defaults emphasize current length, blocklist, paste/autofill, and compromise-driven rotation guidance.

Minimum length

Maximum accepted length

Authentication context

NIST guidance for centrally verified passwords rejects arbitrary composition rules and routine expiration, while emphasizing sufficient length and blocking commonly used or compromised values. Adapt any policy to your actual authentication system and risk model.

Modern password guidance without false certainty

keeps password/passphrase generation and review browser-local while shifting guidance toward length, uniqueness, common-password blocking, password-manager compatibility, MFA, and compromise-driven changes rather than arbitrary composition rules or guaranteed crack-time claims.

Security boundary

A local meter can flag obvious patterns but cannot prove that a password is safe, unused elsewhere, or absent from every breach corpus. Do not paste sensitive production password exports into batch tools; generate unique secrets locally and store them in an appropriate password manager.