Password Generator With Requirements

Why sites have password rules

If you have ever typed a new password three times while a red message told you what was still wrong, you have met the impossible ask: invent something random, remember it, and satisfy a rulebook someone else wrote. For years the standard advice was to mix in capitals, numbers and symbols, and many sign-up forms, workplace policies and school systems still enforce exactly that.

Other rules come from the systems themselves. Some older software caps how long a password can be or refuses certain symbols, and some policies are copied from audit checklists that nobody has revisited. None of that is your fault, and none of it should be a puzzle you solve by hand.

Paste the rules. Let the tool do the translating.

What NIST actually recommends

The U.S. National Institute of Standards and Technology publishes the password guidance most security teams start from. The current version, NIST SP 800-63B rev 4, says three things that matter here:

• Length over composition. A password used on its own must be at least 15 characters. One used alongside a second step, such as a code, must be at least 8.
• No forced composition rules. Sites “SHALL NOT impose other composition rules (e.g., requiring mixtures of different character types).”
• Room for long passwords. Sites should accept passwords of at least 64 characters.

So why does your site still ask for a symbol? Many have not caught up yet. This tool follows the rules your site actually enforces, and when the site allows it, it makes the password at least 15 characters long. Our 15-character password generator explains why that length is the line, and the password checker shows how an existing password holds up.

Checked November 9, 2026 against NIST SP 800-63B rev 4, section 3.1.1.2.

Frequently asked questions

Why does my company still require symbols?

Many password policies were written before NIST changed its advice, and some are tied to audit checklists or older systems that are slow to change. NIST SP 800-63B rev 4 says sites shall not require a mix of character types, but your IT department decides what your login accepts. Follow the rule you were given, and if you want to make the case for change, point them to NIST's password section.

Is it safe to paste my company's rules here?

Yes. The rules and the password stay in this browser tab. The page does not send them anywhere, does not save them, and does not put them in the address bar or the page title. Password rules are rarely secret anyway: sites usually show them on the sign-up or change-password screen. Close the tab and they are gone.

What if the site says my password doesn't meet the rules?

Check three things. First, the “We couldn't read this line” box: set any rule we missed in the checklist. Second, the symbols: some sites reject a symbol they never mention, so remove it from “Symbols it may use” or switch symbols off if the site allows that. Third, the “Rules you'll need to check yourself” list, such as not reusing an old password. Then press Generate another.

Can it avoid my username or name?

No. We don't ask for your name or username, so the tool can't check for them. A random password is unlikely to contain them, but if your site has that rule, look the password over before you use it.