Password Policy Builder
Build a NIST SP 800-63B aligned password policy for your organization. Configure 20+ parameters, preview the live policy document, check your NIST alignment score, and export a ready-to-implement policy.
Length Requirements
The shortest password length your system will accept.
The longest password length your system will accept.
Complexity Rules
Passwords must contain at least one uppercase letter (A-Z).
Passwords must contain at least one lowercase letter (a-z).
Passwords must contain at least one numeric digit (0-9).
Passwords must contain at least one special character (!@#$ etc.).
Allow users to create long, memorable passphrases instead of complex passwords.
Blocklist & Validation
Reject passwords found in breached password lists or common dictionaries.
Reject passwords that are simple dictionary words or predictable patterns.
Reject passwords containing the user's name, username, company name, or email.
Multi-Factor Authentication
All user accounts must enroll in MFA. Password alone is insufficient.
Which MFA methods are permitted for authentication.
Password Lifecycle
How often users must change their password, if at all.
Number of previous passwords the system remembers to prevent reuse.
Number of days after a forced reset before the old password stops working.
Account Lockout
Number of consecutive failed attempts before the account is temporarily locked.
How long an account remains locked after exceeding failed attempts.
Best Practices
Policy explicitly encourages the use of approved password managers.
Users can reset their own password without admin intervention.
Special rules for non-human (service/application) accounts.
Password, MFA & Account Security
Passkeys, password managers, and MFA fatigue attacks
Your new policy needs buy-in to be effective. This course teaches the passphrase and MFA habits your policy requires.
Free to use this tool, no signup required. Training is billed per seat, annually.