Password Policy Generator
Turn password rules into a readable policy, a validation regex, an HTML input with pattern and passwordrules, and JSON config. Presets for NIST and PCI.
0 = no maximum
Out of uppercase, lowercase, digits, symbols (0 = off).
0 = off
0 = off
Traditional complexity rules. Modern guidance (NIST, OWASP) recommends length and blocklists instead, because these rules push people towards predictable patterns like "Password1!".
Always enforce the policy on the server too. The regex counts UTF-16 code units, and “symbol” means any character that is not A–Z, a–z or 0–9.
What is Password Policy Generator?
Define password requirements once and get them in every format you need: a readable policy text for users, a regular expression for validation, a ready-made HTML password input with pattern and Apple's passwordrules attribute, and a JSON configuration.
How to use Password Policy Generator
- Start from a Policy preset or set the rules yourself.
- Copy the Policy text for your documentation or sign-up page.
- Copy the Regular expression or the HTML input for client-side validation.
- Use the JSON output as configuration for your backend.
Example
Classic preset: 8–64 characters, upper, lower, digit, symbol
^(?=.*[A-Z])(?=.*[a-z])(?=.*[0-9])(?=.*[^A-Za-z0-9]).{8,64}$
passwordrules: minlength: 8; maxlength: 64; required: upper; required: lower; required: digit; required: special; allowed: ascii-printable; When to use Password Policy Generator
Use it when implementing or documenting a password policy. Always enforce the same rules on the server; client-side regexes are only for user feedback.
How Password Policy Generator works
Required character types become lookaheads such as (?=.*[A-Z]); 'at least N of 4 categories' becomes an alternation of all N-combinations of lookaheads; 'no more than N identical characters in a row' becomes (?!.*(.)\1{N}); length becomes .{min,max} (or \S without spaces). The passwordrules value follows Apple's password rules syntax (minlength, maxlength, required, allowed, max-consecutive). Rules that a regex cannot express (unique characters, blocklist, username) are listed separately.
Common Use Cases
- Generating validation regexes for sign-up forms
- Adding passwordrules so Safari generates compliant passwords
- Writing user-facing password requirements
- Keeping frontend and backend rules in sync via JSON
Security Note
Client-side validation can be bypassed. Enforce the policy on the server and hash passwords with Argon2id, scrypt or bcrypt.
FAQs
Which regex flavours does the output support?
JavaScript, PCRE (PHP), Python re and Java all accept the lookahead syntax used.
What is the passwordrules attribute?
An HTML attribute proposed by Apple that tells Safari and iCloud Keychain which passwords a site accepts, so generated passwords pass your validation.
Why can't the regex check the blocklist?
Checking against thousands of common or breached passwords requires a lookup on the server, not a pattern.