Password Policy Builder
Build password requirements for your organization by configuring password length, complexity and character requirements.
Build your password policy
Choose a starting point or configure the requirements yourself.
Choose a starting point
Presets provide a convenient starting configuration and can be adjusted at any time.
Character requirements
Choose which character types passwords must contain.
Minimum character counts
Optionally require more than one character from each selected type.
Password policy summary
A readable summary based on your selected requirements.
Policy observations
Things to consider before applying this configuration.
Looking beyond password policies? Assess your organization's PAM readiness.
Use this as a starting point
Password requirements should reflect your organization's security needs, authentication controls, account types and the systems where passwords will be used. Review your policy before applying it in production.
Good password policies balance security and usability
Password requirements should make credentials harder to compromise without encouraging predictable behaviour or unnecessary complexity.
Prioritise sufficient length
Longer passwords increase the available search space and can provide greater resistance to password guessing attacks.
Match requirements to the risk
Privileged accounts and sensitive systems may warrant different password requirements from lower-risk accounts and applications.
Apply policies consistently
Clearly defined policies make it easier to apply consistent password requirements across users, accounts and systems.
Password Policy Builder FAQ
Common questions about creating and managing password policies.
A password policy defines requirements for how passwords should be created and managed. Requirements can include minimum length, character types and other controls appropriate to the accounts and systems being protected.
Password length should reflect the security requirements of the account and system. Longer passwords generally provide greater resistance to password guessing attacks, provided they are not based on predictable patterns.
Not necessarily. Different systems may have different technical limitations and security requirements. Privileged and high-value accounts may also warrant different requirements from standard user accounts.
Yes. Passwordstate supports multiple configurable Password Strength Policies so different systems, accounts and security contexts can use different password requirements.
