01
8 characters is the floor
If you choose the password, it must be at least 8 characters. If the system generates it with an approved random number generator, 6 is enough. The CJIS preset here makes 16.
Free tool · Runs in your browser
CJIS password
generator.
Make a password for systems that handle criminal justice information. This generator follows the memorized-secret rules in the FBI CJIS Security Policy v6.1: at least 8 characters when you choose it, long passphrases and spaces allowed, and no forced character mixes. The preset uses 16 random characters for extra margin, and nothing you make is stored or sent.
generating…
—
NATO phonetic alphabet. Say “capital” or “lowercase” before each letter.
Preset
Length
16 characters
Only symbols typed the same way on US, UK, Spanish and Latin American keyboards, with no AltGr or accent keys: ! $ % & * ( ) - _ = + . , : ; / ?
l 1 I O 0
Randomness
Roll five dice, or one die five times, and type the numbers in order. Each group of five picks one word. Spaces don't matter, and your rolls never leave this page. In English, this is the EFF dice method, so your words match the printed EFF list.
Words
6 words
Word language
Separator
Words come from the EFF long wordlist (7,776 words, CC BY 3.0 US).
7,776 common Spanish words with no accents, so they type the same on any keyboard. Built by Veteran Solutions from wordfreq data (CC BY-SA 4.0); list license and credits.
Length
6 digits
Skips repeats (1111, 1212), runs (1234, 2468), keypad lines (2580), doubled digits (1122), and years or dates (1985, 0704, 071589). A PIN is only safe where the device locks or wipes after a few wrong tries, like a phone, bank card, or door lock. Use 6 digits or more when you can, and never use a PIN as a password.
How many
10 codes
Code length
Characters
Backup or break-glass codes for a system you manage, or a shared account's recovery sheet. Letters skip look-alikes (0, 1, i, l, o), and every code is unique. For a website's own recovery codes, keep the ones the site gives you. The emergency kit is a one-page sheet you fill in by hand; only these codes are printed on it.
Optional. Sends only the first 5 characters of a SHA-1 hash to Have I Been Pwned. Your password never leaves this page.
The strength check runs on your device and is a rough estimate. It spots common words, sequences, keyboard patterns, repeats, and years. Nothing is sent unless you click Check breaches.
Wi-Fi QR codemade on this device
Enter your network name to make a QR code guests can scan to join.
Network
Password
Set your router to this password first, then print the card. The code uses the standard WPA format, which iPhone and Android cameras read for WPA2 and WPA3 networks. Your network name never leaves this page.
Bulk generate
Uses the settings above, up to 500. With usernames, you get one row per user and no password contains its username. Usernames stay on this page.
Every password is generated locally, right in your browser, using its built-in cryptographic random generator. Nothing you generate here is ever stored, logged, or transmitted — not to Veteran Solutions, not to anyone. The only outside request is the optional breach check in Check mode, which sends 5 characters of a hash, never the password.
Last updated
How it works
The CJIS password rules, built in.
The CJIS Security Policy (v6.1, June 25, 2026) sets the rules for people and systems that handle criminal justice information. Here is what it says about passwords.
02
Passphrases and a blocklist
The policy requires allowing long passwords and passphrases with spaces and all printable characters, and requires checking new passwords against a list of common, expected, or compromised ones. Use Check to test yours.
03
Local only
The password is made by code running in this page with your browser's cryptographic random generator. It is not sent, logged, or saved.
What CJIS requires
CJIS Security Policy v6.1, IA-5 and IA-5(1), in plain English.
These rules come from the Authenticator Management control (IA-5) and its enhancement for memorized secrets, IA-5(1)(a). They bind the agency and the system, so some are about how the system is set up, not just the password you pick. “Shall” means required.
| Topic | What the policy says | What it means for you |
|---|---|---|
| Length, chosen by you | At least 8 characters (shall) | The floor. This preset makes 16. |
| Length, system-generated | At least 6 characters when chosen by the system using an approved random number generator (shall) | Applies to passwords the system issues to you. |
| Long passwords and passphrases | Allow user selection of long passwords and passphrases, including spaces and all printable characters | Phrases with spaces are allowed. Try the passphrase generator. |
| Common and breached passwords | Keep a list of commonly used, expected, or compromised passwords; update it quarterly; compare new passwords and, quarterly, current ones. Tell the user why a password was rejected | Check yours with Check in the password generator. |
| Changing passwords | Change or refresh memorized secrets annually or when there is evidence of compromise (IA-5, item f) | Unlike NIST SP 800-63B-4, CJIS still has a yearly change. Follow your agency's policy. |
| After account recovery | Require immediate selection of a new password | Pick a new one at once; do not keep a reset code as your password. |
| Truncation and hints | No truncating the secret; no stored hints; no security questions | If a site cuts your password short or asks for a pet's name, tell the system owner. |
| Multi-factor sign-in | Required for privileged accounts (IA-2(1)) and non-privileged accounts (IA-2(2)) | A password is one factor. Your agency decides which second factor is used. |
The password rules are the same in v6.0 (December 27, 2024) and v6.1 (June 25, 2026). Read the source: FBI CJIS Security Policy Resource Center. Your agency's CJIS Systems Officer can say which version and local rules apply to you.
FAQ
Common questions.
How many characters does CJIS require for a password?
At least 8 characters when you choose it, and at least 6 when the system generates it with an approved random number generator (CJIS Security Policy v6.1, IA-5(1)(a)). The CJIS preset here makes 16 random characters, well above the minimum.
Does CJIS require special characters or a mix of character types?
The memorized-secret rules in IA-5(1)(a) set a minimum length and a blocklist, not required character types. The policy asks the system to allow all printable characters and spaces. Your agency may add its own rules, so follow them if they are stricter.
Does CJIS require changing passwords?
Yes. IA-5 says memorized secrets are changed or refreshed annually or when there is evidence of compromise. This differs from NIST SP 800-63B-4, which does not allow forced periodic changes.
Does using this tool make me CJIS compliant?
No. It makes a password that follows the published length and character rules. CJIS also requires multi-factor sign-in, a blocklist, and secure systems. Your agency and its CJIS Systems Officer decide what applies to you. Veteran Solutions, LLC is not affiliated with the FBI or any CJIS agency. If you need help preparing, we can help.
Where is the exact CJIS text?
In the FBI CJIS Security Policy, Authenticator Management (IA-5) and IA-5(1), Memorized Secret Authenticators and Verifiers. The link is in the table above.
More free tools
See all free tools →
Veteran Solutions, LLC
Need help with your network?
Monitoring assessments, NOC runbooks, network administration, and hands-on hardware deployment from a service-disabled veteran-owned small business in Waco, Texas.