01
No fixed length
Requirement 3.5.7 says to enforce a minimum password complexity and a change of characters when new passwords are created. It does not give a number. Your company defines it in its System Security Plan.
Free tool · Runs in your browser
CMMC password
generator.
Make a password for a CMMC Level 2 environment and see what the rules actually say. CMMC Level 2 uses NIST SP 800-171 and gives no password length: your company sets it in its System Security Plan. This preset uses our default of 15 characters with one of each type, which follows the DoD STIG. Runs in your browser; what you make is never stored or sent.
generating…
—
NATO phonetic alphabet. Say “capital” or “lowercase” before each letter.
Preset
Length
16 characters
Only symbols typed the same way on US, UK, Spanish and Latin American keyboards, with no AltGr or accent keys: ! $ % & * ( ) - _ = + . , : ; / ?
l 1 I O 0
Randomness
Roll five dice, or one die five times, and type the numbers in order. Each group of five picks one word. Spaces don't matter, and your rolls never leave this page. In English, this is the EFF dice method, so your words match the printed EFF list.
Words
6 words
Word language
Separator
Words come from the EFF long wordlist (7,776 words, CC BY 3.0 US).
7,776 common Spanish words with no accents, so they type the same on any keyboard. Built by Veteran Solutions from wordfreq data (CC BY-SA 4.0); list license and credits.
Length
6 digits
Skips repeats (1111, 1212), runs (1234, 2468), keypad lines (2580), doubled digits (1122), and years or dates (1985, 0704, 071589). A PIN is only safe where the device locks or wipes after a few wrong tries, like a phone, bank card, or door lock. Use 6 digits or more when you can, and never use a PIN as a password.
How many
10 codes
Code length
Characters
Backup or break-glass codes for a system you manage, or a shared account's recovery sheet. Letters skip look-alikes (0, 1, i, l, o), and every code is unique. For a website's own recovery codes, keep the ones the site gives you. The emergency kit is a one-page sheet you fill in by hand; only these codes are printed on it.
Optional. Sends only the first 5 characters of a SHA-1 hash to Have I Been Pwned. Your password never leaves this page.
The strength check runs on your device and is a rough estimate. It spots common words, sequences, keyboard patterns, repeats, and years. Nothing is sent unless you click Check breaches.
Wi-Fi QR codemade on this device
Enter your network name to make a QR code guests can scan to join.
Network
Password
Set your router to this password first, then print the card. The code uses the standard WPA format, which iPhone and Android cameras read for WPA2 and WPA3 networks. Your network name never leaves this page.
Bulk generate
Uses the settings above, up to 500. With usernames, you get one row per user and no password contains its username. Usernames stay on this page.
Every password is generated locally, right in your browser, using its built-in cryptographic random generator. Nothing you generate here is ever stored, logged, or transmitted — not to Veteran Solutions, not to anyone. The only outside request is the optional breach check in Check mode, which sends 5 characters of a hash, never the password.
Last updated
How it works
CMMC sets the topics. Your SSP sets the numbers.
CMMC Level 2 is built on NIST SP 800-171 Revision 2. Its password requirements say what to enforce, not how long.
02
Our default, labeled as ours
The preset uses 15 characters with one of each type. That is our default, taken from the DoD STIG, not a number CMMC requires. If your SSP says something different, follow your SSP.
03
Local only
The password is made by code running in this page with your browser's cryptographic random generator. It is not sent, logged, or saved.
What CMMC requires
CMMC Level 2 password practices, from NIST SP 800-171 Rev. 2.
These are the Identification and Authentication practices that deal with passwords. They name the topic and leave the values to the organization.
| Practice | What it says | What it means for you |
|---|---|---|
| IA.L2-3.5.7 | Enforce a minimum password complexity and change of characters when new passwords are created | Set a minimum length and complexity in your SSP, and make a new password differ from the old one by a set number of characters. |
| IA.L2-3.5.8 | Prohibit password reuse for a specified number of generations | Your SSP picks the number of old passwords that cannot be reused. |
| IA.L2-3.5.9 | Allow temporary password use for system logons with an immediate change to a permanent password | Replace any temporary or reset password right away. |
| IA.L2-3.5.10 | Store and transmit only cryptographically protected passwords | This is for the system: salted one-way hashes, no plain text. |
| IA.L2-3.5.11 | Obscure feedback of authentication information | Password fields show dots or asterisks. |
CMMC Level 1 (FAR 52.204-21) has no password length or complexity rule. Read the source: NIST SP 800-171 Revision 2, section 3.5. Veteran Solutions can help you write these values into your SSP; our password policy generator is a starting point.
FAQ
Common questions.
What password length does CMMC require?
None is fixed. CMMC Level 2 uses NIST SP 800-171, and requirement 3.5.7 says to enforce a minimum password complexity without giving a number. Your company sets the length in its System Security Plan. Our preset uses 15 characters with one of each type, which follows the DoD STIG.
Is the 15-character preset a CMMC requirement?
No. It is our default, labeled as ours. It fits the Windows (14) and RHEL (15) STIG minimums, so it is a safe choice for many DoD contractors, but your SSP and your assessor decide what counts.
Does CMMC Level 1 have a password rule?
No. Level 1 follows FAR 52.204-21 and asks you to authenticate users but gives no password length or complexity.
Does using this tool make me CMMC compliant?
No. It makes a password that fits a common rule. CMMC also covers multi-factor sign-in, how passwords are stored, and policies and records. Veteran Solutions, LLC is not affiliated with the DoD or the Cyber AB. If you need help getting ready, we can help.
Where is the exact text?
In NIST SP 800-171 Revision 2, section 3.5 (Identification and Authentication). The link is in the table above.
More free tools
See all free tools →
Veteran Solutions, LLC
Need help with your network?
Monitoring assessments, NOC runbooks, network administration, and hands-on hardware deployment from a service-disabled veteran-owned small business in Waco, Texas.