Password Policy Generator
Generate a short, readable password and MFA policy for your staff handbook. It follows current guidance such as NIST SP 800-63B: favour length over complexity rules, block breached passwords, require MFA, and drop forced periodic resets.
Our company — Password and Account Security Policy 1. Purpose This policy sets simple rules for passwords and sign-ins so that company accounts and customer data stay protected. 2. Password length and choice - Passwords must be at least 12 characters long. Longer passphrases are encouraged. - Use a unique password for every account. Never reuse a work password elsewhere. - Do not use passwords that appear in known data breaches, or obvious choices such as the company name, "Password1" or your own name. - You do not need to use special patterns of symbols; length and uniqueness matter more. 3. Password manager - Store work passwords in our company password manager. Let it generate random passwords for you. - Do not keep passwords in spreadsheets, notes apps, email or on paper at your desk. 4. Multi-factor authentication - Multi-factor authentication (MFA) must be turned on for email, the password manager, banking, payroll, cloud storage and any admin account. - Prefer an authenticator app or security key over SMS codes. - Never approve an MFA prompt you did not start, and never read out an MFA code to anyone. 5. Changing passwords - Passwords do not need to be changed on a fixed schedule. - Change a password immediately if it may have been exposed: a phishing email you clicked, a breach notice, or a lost device. 6. Sharing - Never share your personal password. Shared team logins must be shared through our company password manager, not by email or chat. 7. Leaving the company - Access is removed on the last working day. Shared passwords the person knew are changed. 8. Reporting - Report a suspected compromised account, lost device or suspicious login prompt to the IT contact straight away. Reporting quickly is never a disciplinary matter.
Why this policy looks different from older ones
Older policies forced frequent password changes and complex character rules. Research behind modern guidance found these push people towards predictable patterns like Spring2025!. Current advice is to require long, unique passwords stored in a password manager, protect important accounts with MFA, and change passwords only when there is a reason to.
Frequently asked questions
Is this policy legally binding?
It is a template, not legal advice. Adapt it to your business and any industry rules you must follow, and have staff acknowledge it.
Should passwords expire every 90 days?
Current NIST guidance says no, unless there is evidence of compromise. Forced expiry tends to produce weaker, predictable passwords.
What minimum length should I choose?
At least 12 characters for staff accounts is a common, practical minimum; 15+ for administrators.
More free security tools
Advertisement