01
Per product, per version
The Windows STIGs ask for a 14-character minimum. The RHEL STIGs ask for 15 and for at least one upper-case letter, lower-case letter, number, and special character. Other products can differ.
Free tool · Runs in your browser
DoD STIG password
generator.
Make a password that meets the DISA STIG password minimums: 15 characters with an upper-case letter, a lower-case letter, a number, and a symbol. That covers the Windows 10 and 11 STIGs (14 characters) and the RHEL 8 and 9 STIGs (15). Runs in your browser; what you make is never stored or sent.
generating…
—
NATO phonetic alphabet. Say “capital” or “lowercase” before each letter.
Preset
Length
16 characters
Only symbols typed the same way on US, UK, Spanish and Latin American keyboards, with no AltGr or accent keys: ! $ % & * ( ) - _ = + . , : ; / ?
l 1 I O 0
Randomness
Roll five dice, or one die five times, and type the numbers in order. Each group of five picks one word. Spaces don't matter, and your rolls never leave this page. In English, this is the EFF dice method, so your words match the printed EFF list.
Words
6 words
Word language
Separator
Words come from the EFF long wordlist (7,776 words, CC BY 3.0 US).
7,776 common Spanish words with no accents, so they type the same on any keyboard. Built by Veteran Solutions from wordfreq data (CC BY-SA 4.0); list license and credits.
Length
6 digits
Skips repeats (1111, 1212), runs (1234, 2468), keypad lines (2580), doubled digits (1122), and years or dates (1985, 0704, 071589). A PIN is only safe where the device locks or wipes after a few wrong tries, like a phone, bank card, or door lock. Use 6 digits or more when you can, and never use a PIN as a password.
How many
10 codes
Code length
Characters
Backup or break-glass codes for a system you manage, or a shared account's recovery sheet. Letters skip look-alikes (0, 1, i, l, o), and every code is unique. For a website's own recovery codes, keep the ones the site gives you. The emergency kit is a one-page sheet you fill in by hand; only these codes are printed on it.
Optional. Sends only the first 5 characters of a SHA-1 hash to Have I Been Pwned. Your password never leaves this page.
The strength check runs on your device and is a rough estimate. It spots common words, sequences, keyboard patterns, repeats, and years. Nothing is sent unless you click Check breaches.
Wi-Fi QR codemade on this device
Enter your network name to make a QR code guests can scan to join.
Network
Password
Set your router to this password first, then print the card. The code uses the standard WPA format, which iPhone and Android cameras read for WPA2 and WPA3 networks. Your network name never leaves this page.
Bulk generate
Uses the settings above, up to 500. With usernames, you get one row per user and no password contains its username. Usernames stay on this page.
Every password is generated locally, right in your browser, using its built-in cryptographic random generator. Nothing you generate here is ever stored, logged, or transmitted — not to Veteran Solutions, not to anyone. The only outside request is the optional breach check in Check mode, which sends 5 characters of a hash, never the password.
Last updated
How it works
There is no single DoD password rule.
DISA writes a STIG for each product and version, so the numbers differ. This preset is picked to satisfy the common ones.
02
15 with one of each
That meets both families. “One of each” keeps the result fully random: the tool draws a new password until it has every required type, so every qualifying password is equally likely.
03
Local only
The password is made by code running in this page with your browser's cryptographic random generator. It is not sent, logged, or saved.
What the STIGs say
Password findings in the Windows and RHEL STIGs.
These are findings an auditor checks. Always read the STIG and release for your own product, because DISA updates them.
| STIG | Finding | Requirement |
|---|---|---|
| Windows 10 | V-220745 (WN10-AC-000035) | Passwords must, at a minimum, be 14 characters |
| Windows 11 | V-253303 (WN11-AC-000035) | Passwords must, at a minimum, be 14 characters |
| RHEL 8 | V-230369 | Passwords must have a minimum of 15 characters (minlen = 15 in pwquality.conf) |
| RHEL 8 | V-230357 and related | At least one upper-case character (ucredit = -1); matching findings require lower-case, number, and special characters |
| RHEL 9 | V-258107 | Passwords must be created with a minimum of 15 characters (minlen = 15) |
Read the sources: DoD Cyber Exchange, STIGs or a STIG viewer for the product you run. In an RHEL pwquality file, “-1” means at least one of that type.
FAQ
Common questions.
What is the DoD STIG minimum password length?
It depends on the product. The Windows 10 and Windows 11 STIGs require at least 14 characters. The RHEL 8 and RHEL 9 STIGs require at least 15. This preset makes 15 so it covers both.
Does a STIG require upper-case, lower-case, numbers, and symbols?
The RHEL STIGs do: one of each. The Windows STIG findings above set only a minimum length, although Windows can also enforce complexity through other settings. Check the STIG for your product.
Is there one DoD password policy?
No. DISA publishes a separate STIG for each product and version, and each sets its own values. DoD and contractor policies may add more.
Does using this tool make my system STIG compliant?
No. It makes a password that fits the length and character rules. A STIG covers many more settings, such as lockout, history, and storage. Veteran Solutions, LLC is not affiliated with DISA or the DoD. If you need help with a STIG checklist, we can help.
Where are the exact requirements?
In the STIG for your product on DoD Cyber Exchange, or a STIG viewer. The finding numbers are in the table above.
More free tools
See all free tools →
Veteran Solutions, LLC
Need help with your network?
Monitoring assessments, NOC runbooks, network administration, and hands-on hardware deployment from a service-disabled veteran-owned small business in Waco, Texas.