Password Policy Generator
Generate a password policy and its rules for your service.
The password policy generator turns a few choices — minimum length, character class requirements, maximum age, account lockout threshold and whether MFA is required — into a human-readable password policy plus a matching client-side validation regular expression. It outputs both Korean and English wording that you can paste straight into a security policy document, a sign-up form, or a development spec.
Everything runs entirely in your browser and no input ever leaves the page. Use it when you want to follow modern NIST guidance — prioritising length and avoiding forced periodic changes — while still expressing the minimum requirements your organisation needs in clear, copy-ready language.
| Minimum length | 12 |
|---|---|
| Required classes | uppercase, lowercase, digits |
| Maximum age | no rotation |
| Lockout | after 5 failures |
| MFA | required |
- Passwords must be at least 12 characters long. - Must contain at least one uppercase letter (A–Z). - Must contain at least one lowercase letter (a–z). - Must contain at least one digit (0–9). - No periodic forced change is required unless there is clear evidence of compromise. - Accounts are temporarily locked after 5 consecutive failed logins. - Multi-factor authentication (MFA) is required for all accounts.
^(?=.*[A-Z])(?=.*[a-z])(?=.*\d).{12,}$What goes into the policy
The tool builds a policy from five dimensions. Each becomes a bullet in the generated wording, and the character-class requirements are also compiled into a regular expression you can drop into a sign-up form.
- Minimum length: the fewest characters allowed. Length is the single strongest factor.
- Character classes: which of uppercase, lowercase, digits and symbols are required.
- Maximum age: how many days before a change is required (0 means no rotation).
- Account lockout: how many failed attempts before the account is locked.
- MFA: whether multi-factor authentication is mandatory.
NIST guidance: length first, avoid forced rotation
The US NIST Digital Identity Guidelines (SP 800-63B) argue that adequate length is far more effective than stacking up complexity rules. The key recommendations are:
- Allow at least 8 characters, and ideally long passphrases up to 64 characters.
- Rules that force specific character classes tend to produce predictable patterns such as
Password1!. - Do not require periodic forced changes unless there is clear evidence of compromise. Frequent rotation leads to weaker passwords.
- Screening against known-breached passwords and adding MFA is more effective than complexity rules.
This generator lets you set the maximum age to 0 (no rotation) so your policy can stay aligned with that guidance. Apply the validation regex it outputs alongside the wording to your sign-up form to handle both authoring the policy and validating it on the client in one place.
How to use the generated regex
The regex validates the selected character-class requirements together with the minimum length on the client. Each class is expressed as a lookahead — for example, at least one uppercase letter is (?=.*[A-Z]). Treat it as instant form feedback only; real authentication must re-validate length, breach status and more on the server.