Home

If you find any mistakes here or anywhere else on my website, email website@CoryHufford.com.

Offline Complex Password Helper

October 10, 2026

As of 2025, the National Institute of Standards and Technology (NIST) says password authentication systems:

• Must:
  • Require passwords be at least 15 characters long, or at least 8 if multi-factor authentication is required
  • Require a password be changed if there's evidence that it's compromised
  • Enforce a rate limit
  • Require passwords, but not password substrings, be checked against a blacklist of dictionary words and common or compromised passwords
  • Provide the reason for rejection when a user attempts to set a blacklisted password
  • Verify passwords in full (not truncated)
  • Allow password managers and autofill
  • Count each Unicode code point as a character for the purpose of determining password length, if Unicode is accepted
• Must not:
  • Require passwords meet composition rules (e.g. one uppercase, one lowercase, one numeral)
  • Require periodic password changes
  • Allow storing hints
  • Use knowledge-based authentication (e.g. "What was the name of your first pet?")
• Should:
  • Allow passwords to be at least 64 characters long
  • Accept all printable ASCII and Unicode characters, including space
  • Allow pasting passwords
  • Allow passwords to be displayed while being entered
  • Normalize Unicode, if Unicode is accepted, with Normalization Process for Stabilized Strings (NPSS) and Normalization Form C (NFC; also sometimes called Normalization Form Canonical Composition)
• May:
  • Make limited allowances for mistyping, like removing leading or trailing whitespace or ignoring case for the leading character, as long as the password is still the required minimum length and the complexity is not significantly reduced

These are documented in NIST document SP 800-63B, Revision 4. Some of these points, like recommending against composition rules, date back to at least the first revision of this document from 2017. Revision 4 also states that password blacklists (called blocklists in the document) "should be of sufficient size to prevent subscribers from choosing passwords that attackers are likely to guess before reaching the attempt limit", but that "excessively large blocklists are of little incremental security benefit".

Despite it being known for a decade or more that anything more restrictive than a password minimum length and blacklist is probably not useful for, and might be counterproductive to, security, I still run into many systems with obnoxious password requirements. A decent number of those systems are either air-gapped or heavily restricted, so password managers are not an option. In those cases, I use a grid like the one shown below printed on a small piece of paper to help create passwords. The first one of these grids I ever used was given to me by the IT help desk for the network with the worst password requirements I've dealt with; they kept a stack of these on their desk to hand out because their users couldn't come up with compliant passwords they could remember.

Clicking Generate will populate each square with a random string containing a lowercase letter, uppercase letter, numeral, and special character. Any word, number, or pattern can be used as a key, and the corresponding random strings become the password. For some extra security, you could also add a separator character or string between each random substring. The Extra Symbols checkboxes give you the option of removing some symbols that are either difficult to type or blocked in a particular(ly bad) password system. The Print button should bring up the browser print dialog to print the grid.

Obviously this has security implications, and you shouldn't use something like this if you don't have to. Use a fully offline password database like KeePass if possible.

┌──────┬──────┬──────┬──────┬──────┬──────┐
│ a    │ b    │ c    │ d    │ e    │ f    │
│      │      │      │      │      │      │
├──────┼──────┼──────┼──────┼──────┼──────┤
│ g    │ h    │ i    │ j    │ k    │ l    │
│      │      │      │      │      │      │
├──────┼──────┼──────┼──────┼──────┼──────┤
│ m    │ n    │ o    │ p    │ q    │ r    │
│      │      │      │      │      │      │
├──────┼──────┼──────┼──────┼──────┼──────┤
│ s    │ t    │ u    │ v    │ w    │ x    │
│      │      │      │      │      │      │
├──────┼──────┼──────┼──────┼──────┼──────┤
│ y    │ z    │ 0    │ 1    │ 2    │ 3    │
│      │      │      │      │      │      │
├──────┼──────┼──────┼──────┼──────┼──────┤
│ 4    │ 5    │ 6    │ 7    │ 8    │ 9    │
│      │      │      │      │      │      │
└──────┴──────┴──────┴──────┴──────┴──────┘

Back to top

Home