Password policy generator

A password policy is the set of rules a signup or reset form enforces before it accepts a secret. Length is the rule that matters most. A long password or passphrase resists guessing better than a short one with a forced symbol. Character classes, such as an uppercase letter or a digit, are optional extras. They help only when they do not push people into a pattern like Password1!. A maximum that is too low rejects a passphrase. A minimum under 12 is short for anything people might reuse.

This form writes that policy in the browser. The lengths and the checkboxes are not sent anywhere. The example string is built on your device from random bytes so you can see a shape that meets the rules. It is an illustration, not a password you should use for an account. Do not store the password itself. Store a slow hash, and compare it in constant time. The policy text is what you put next to the form and in the check that runs before the hash.

How to choose the numbers

Start at a minimum of 12 and a maximum of at least 64, preferably 128. Allow every character people can type, including spaces, so a passphrase works. Require lowercase and uppercase only if you have a reason. A digit requirement is common and easy to meet. A symbol requirement is the one most likely to produce a predictable substitution. If you require a class, say so in the form before the person submits, not only in an error afterward.

The checklist under the policy is the same list in short lines: minimum, maximum, and each required class. Copy the paragraph into a design note or a help string. The warnings appear when the minimum is under 12, when no class is required, or when the maximum is under 64. None of those warnings block you from copying the text. They are there so a short policy is a choice you can see.

Common mistakes

• Setting a maximum of 16 or 20. That rejects passphrases and suggests the password is stored in a short column.
• Requiring a symbol and then banning characters your hasher can store. If you accept Unicode, say so. If you do not, list the set.
• Showing the rules only after a failure. Put them next to the field.
• Generating a password for the user and emailing it. Let them choose, or use a reset link that expires.
• Treating this text as proof that an account is safe. The hash, the reset flow, and rate limits do that work.

Nothing on this page is stored, and nothing is checked against a breach list, because that would be a network call. If you need a breach check, do it on your own server with a range query, not by sending the password to this site.