Password rules · live check
Password Requirements
Check a password against published password requirements - starting with NIST's current guidance - and generate one that fits in one click.
Type a password above to check it against these rules.
Also required, but not checkable here:
- - Not on a list of commonly used, expected or compromised passwords (checked by the service)
- - At least 8 characters is enough when the password is used together with a second factor
Source: NIST SP 800-63B Revision 4, section 3.1.1.2 (checked 2026-10-06)
Checked in your browser. Your password is never sent or stored. Verify it
What Good Password Requirements Look Like
The U.S. National Institute of Standards and Technology publishes the guidance most password policies are measured against. Its current version, SP 800-63B Revision 4 (August 2025), turns several old habits around:
- Length first. At least 15 characters when the password is the only way to sign in; at least 8 when it is combined with a second factor. Services should accept at least 64 characters.
- No composition rules. Services shall not require a mix of character types such as uppercase, numbers and symbols.
- No forced periodic changes - but a forced change when there is evidence of compromise.
- A blocklist. New passwords are compared with a list of commonly used, expected or compromised passwords.
- Password managers welcome. Autofill must be allowed and pasting should be; password hints and security questions are not allowed.
The check above uses this baseline by default. A password that meets it is long enough by today's standard; whether it is also unpredictable is a different question - try the password strength checker for that.
Password Requirements by Service
| Service | Length | Must include | Checked |
|---|---|---|---|
| Apple Account (Apple ID) | 8+ | upper, lower, digit | 2026-10-06 |
| Microsoft work or school account (Entra ID) | 8-256 | 3 of 4 types | 2026-10-06 |
| Amazon | not published | nothing published | 2026-10-06 |
| TikTok | not published | nothing published | 2026-10-06 |
| 6+ | nothing published | 2026-10-06 | |
| Spotify | not published | nothing published | 2026-10-06 |
| Google Account (Gmail) | not published | nothing published | 2026-10-07 |
| Discord | 8+ | nothing published | 2026-10-07 |
How to Meet Any Password Requirement
Many services still ask for an uppercase letter, a number and a symbol. Rather than bending a memorable word to fit - "Summer2026!" meets most of these rules and is still one of the first guesses an attacker tries - let a generator do it.
"Generate a password that meets these rules" opens the password generator with every character type switched on and a length inside the service's limits. The generator guarantees that every enabled character type appears, so the result meets the composition rules on the first try. Save it in a password manager, and turn on two-factor authentication where the service offers it - see what 2FA is.
Password Requirements FAQs
What are typical password requirements?
Most services set a minimum length, often 8 characters, and many still ask for a mix of uppercase letters, lowercase letters, numbers and symbols. NIST's current guidance asks for length instead: at least 15 characters when the password is the only factor, and no composition rules.
Why does NIST say not to require symbols?
SP 800-63B Revision 4 says verifiers "SHALL NOT impose other composition rules". Composition rules push people towards predictable patterns - a capital first letter, a number and an exclamation mark at the end - while length adds far more to a random password.
Is a 15-character minimum realistic?
Yes, with a password manager or a passphrase. A passphrase of a few random words easily passes 15 characters and is easier to type than a random string of the same strength.
Does my password get sent anywhere when I check it?
No. The check runs in your browser against rules stored in the page. The password is not sent, saved or put in the address, and the field is cleared when you leave the page.
Should I change my password every 90 days?
Not on a schedule. NIST says services shall not require periodic changes, but shall force a change when there is evidence the password was compromised. Change it when it may have leaked, and use a unique password per account so one leak stays one leak.
Why do some sites limit passwords to a short maximum?
Usually for legacy technical reasons. NIST asks services to permit at least 64 characters and to verify the whole password rather than cut it short. A low maximum is a limitation of the service, not a security feature.
Can I paste my password or use a password manager?
You should be able to. NIST says verifiers shall allow password managers and autofill, and should allow pasting. A site that blocks pasting makes long random passwords harder to use.
Are the rules for each service up to date?
Every rule set shows its source and the date it was checked. Services change their rules, so if a password that passes here is rejected, the service's current form wins.