How to use the Password Policy Generator
- 1. Describe your systemName, whether a second factor is required, and the minimum length.
- 2. Pick the rulesBlocklist, composition, expiry, lockout and how passwords are stored.
- 3. GenerateGet a policy document, JavaScript validation code or JSON config, with any points that go against NIST flagged.
What current guidance says
NIST's Digital Identity Guidelines (SP 800-63B, revision 4, 2025) changed password advice. Passwords used on their own must be at least 15 characters (at least 8 when a second factor is required), and at least 64 should be allowed. Composition rules ("one uppercase, one symbol") and forced periodic changes are now SHALL NOT, because they push people towards patterns like Password@123. Instead, every new password must be checked against a blocklist of common and breached passwords. Password managers and paste must be allowed, hints and security questions aren't, and failed attempts are capped at 100.
For storage, the tool follows the OWASP Password Storage Cheat Sheet: Argon2id with at least 19 MiB of memory, 2 iterations and 1 thread; bcrypt with a work factor of at least 10; or PBKDF2-HMAC-SHA256 with 600,000 iterations.
Worked example
The defaults (15-character minimum, 64 maximum, optional second factor, blocklist on, no composition rules, no expiry, slowing down after 10 failed attempts, Argon2id) produce a 10-point policy for the Uncodemy Student Portal that meets NIST SP 800-63B-4. Switch to a 12-character minimum without MFA, add composition rules and 90-day expiry, and turn off the blocklist, and the tool flags 4 points that go against NIST.
Putting it in place
- Count Unicode characters, not bytes, when checking length; the generated code does.
- Use a breached-password list (for example Have I Been Pwned's downloadable lists) for the blocklist.
- Offer passkeys or an authenticator app; they protect far better than any password rule.
Frequently asked questions
My regulator requires complexity rules. What then?
Tick the composition option; the policy includes them and notes that they're a regulatory requirement.
Is NIST binding in India?
No. It's a US standard, but it's widely used as best practice. Check your sector's own rules, for example from RBI or CERT-In, which take priority.
Is the password policy generator free?
Yes. You can open the password policy generator and try everything without signing up. When you generate a policy for the first time, we ask once for your name and WhatsApp number; after that it, and every other Uncodemy tool, opens straight away.