01
15 characters or more
A password used as the only sign-in factor must be at least 15 characters long (section 3.1.1.2). A password used only as part of multi-factor sign-in may be as short as 8. The NIST preset starts at 15.
Free tool · Runs in your browser
NIST password
generator.
Make a password that meets NIST SP 800-63B-4, the federal guideline most password policies copy: at least 15 characters for a password used on its own, with length doing the work instead of forced symbols. It starts at 15 characters, runs in your browser, and what you make is never stored or sent.
generating…
—
NATO phonetic alphabet. Say “capital” or “lowercase” before each letter.
Preset
Length
16 characters
Only symbols typed the same way on US, UK, Spanish and Latin American keyboards, with no AltGr or accent keys: ! $ % & * ( ) - _ = + . , : ; / ?
l 1 I O 0
Randomness
Roll five dice, or one die five times, and type the numbers in order. Each group of five picks one word. Spaces don't matter, and your rolls never leave this page. In English, this is the EFF dice method, so your words match the printed EFF list.
Words
6 words
Word language
Separator
Words come from the EFF long wordlist (7,776 words, CC BY 3.0 US).
7,776 common Spanish words with no accents, so they type the same on any keyboard. Built by Veteran Solutions from wordfreq data (CC BY-SA 4.0); list license and credits.
Length
6 digits
Skips repeats (1111, 1212), runs (1234, 2468), keypad lines (2580), doubled digits (1122), and years or dates (1985, 0704, 071589). A PIN is only safe where the device locks or wipes after a few wrong tries, like a phone, bank card, or door lock. Use 6 digits or more when you can, and never use a PIN as a password.
How many
10 codes
Code length
Characters
Backup or break-glass codes for a system you manage, or a shared account's recovery sheet. Letters skip look-alikes (0, 1, i, l, o), and every code is unique. For a website's own recovery codes, keep the ones the site gives you. The emergency kit is a one-page sheet you fill in by hand; only these codes are printed on it.
Optional. Sends only the first 5 characters of a SHA-1 hash to Have I Been Pwned. Your password never leaves this page.
The strength check runs on your device and is a rough estimate. It spots common words, sequences, keyboard patterns, repeats, and years. Nothing is sent unless you click Check breaches.
Wi-Fi QR codemade on this device
Enter your network name to make a QR code guests can scan to join.
Network
Password
Set your router to this password first, then print the card. The code uses the standard WPA format, which iPhone and Android cameras read for WPA2 and WPA3 networks. Your network name never leaves this page.
Bulk generate
Uses the settings above, up to 500. With usernames, you get one row per user and no password contains its username. Usernames stay on this page.
Every password is generated locally, right in your browser, using its built-in cryptographic random generator. Nothing you generate here is ever stored, logged, or transmitted — not to Veteran Solutions, not to anyone. The only outside request is the optional breach check in Check mode, which sends 5 characters of a hash, never the password.
Last updated
How it works
Length first, as NIST now says.
NIST SP 800-63B-4 (final, August 2025) dropped the old advice to force symbols and change passwords on a schedule. Here is what a person choosing a password needs from it.
02
No forced mixes
NIST says a system shall not impose other composition rules, such as requiring upper case, numbers, or symbols. This tool lets you include them because a random mix adds strength, but nothing is forced.
03
Local only
The password is made by code running in this page with your browser's cryptographic random generator. It is not sent, logged, or saved.
What NIST requires
NIST SP 800-63B-4, section 3.1.1.2, in plain English.
NIST publishes these rules for the systems that check passwords (“verifiers”). Some bind the website or the organization; others tell you what to aim for. “Shall” means required, “should” means recommended.
| Topic | What NIST says | What it means for you |
|---|---|---|
| Length, password on its own | At least 15 characters (shall) | Use 15 or more. The preset starts at 15; go longer for email, banking, and your password manager. |
| Length, with multi-factor | At least 8 characters when the password is only used as part of multi-factor sign-in (shall) | A system may accept 8 here, but longer costs you nothing when a password manager types it. |
| Maximum length | Systems should allow at least 64 characters | Try a long password. If a site cuts you off sooner, that is the site's limit, not NIST's. |
| Composition rules | Systems shall not impose them (no required mix of character types) | Sites should not force symbols or numbers. Adding them yourself is fine. |
| Changing passwords | No periodic changes. Change only on evidence of compromise (shall) | Do not rotate on a calendar. Do change a password after a breach. |
| Blocklist | The whole password is compared with a list of common or compromised passwords (shall) | Use Check in the password generator to test one against known breaches. |
| Unicode and spaces | Systems should accept Unicode; each code point counts as one character | Phrases with spaces are allowed where the site accepts them. |
| Password managers | Systems shall allow password managers and autofill, and should allow paste | Use a password manager. Do not type long random passwords by hand. |
This tool covers your side: a long random password. The rest depends on the website or your organization's policy. Read the source: NIST SP 800-63B-4, Authenticators (see 3.1.1.2).
FAQ
Common questions.
How long should a NIST password be?
At least 15 characters if the password is the only sign-in factor. NIST SP 800-63B-4 allows a minimum of 8 when the password is used only as part of multi-factor sign-in. The NIST preset here starts at 15, and longer is better for important accounts.
Does NIST still require symbols, numbers, and capital letters?
No. NIST says systems shall not impose composition rules such as a required mix of character types. Length matters more. This tool still lets you include all character types, because a random mix adds strength and some sites still demand them.
Does NIST say to change passwords every 90 days?
No. NIST says systems shall not require periodic changes. A password must be changed when there is evidence it has been compromised.
Does using this tool make me NIST compliant?
No. It makes a password that follows the published length rule. NIST SP 800-63B-4 also sets duties for the systems that store and check passwords, such as blocklists and password-manager support. Veteran Solutions, LLC is not affiliated with NIST. If you need help meeting these rules in your business, we can help.
Where is the exact NIST text?
In NIST SP 800-63B-4, Authenticators, section 3.1.1.2 (Password Verifiers). The link is in the table above.
More free tools
See all free tools →
Veteran Solutions, LLC
Need help with your network?
Monitoring assessments, NOC runbooks, network administration, and hands-on hardware deployment from a service-disabled veteran-owned small business in Waco, Texas.