Password Policy Generator

Written Password Policy — computed locally in your browser.

Build a password policy

Minimum length Maximum length

Uppercase Lowercase Digits Symbols

Reuse limit Expiry

Lockout after Two factor

Policy

Matching regular expression:

Validation checklist

Written requirements for your own systems. Nothing is uploaded.

Common questions about the free online password policy generator.

Pick the minimum length, the character classes, the reuse limit, the expiry window, the lockout threshold and whether a second factor is required.

Twelve characters is a sensible minimum for most services and fourteen or more is better for administrators and other high value accounts.

Modern guidance discourages forced rotation unless there is evidence of compromise, so 90 or 180 days is only for regulated environments.

It uses lookaheads to require one character from each selected class and then enforces the minimum and maximum total length in a single pattern.

No. It only writes policy text from the options you choose and never asks for or handles any existing password.

A long cap protects against denial of service attacks on slow hashing functions, and 64 or 128 characters is generous for any human password.

Yes. Length usually adds far more entropy than adding symbols, which is why passphrases are recommended over short complex strings.

You can adapt it for common frameworks, but always check the exact wording your auditor or regulator requires before publishing it.

Store only a salted hash made with bcrypt, scrypt or Argon2 and never keep the original password in a database or a log file.

Last updated: October 10, 2026