What password length does Cyber Essentials require?

Cyber Essentials does not mandate a specific minimum password length, but requires that passwords are not easily guessable and that account lockout or MFA is in place. The NCSC Small Business Guide recommends a minimum of 8 characters for standard accounts and 14+ for administrator accounts. The Work Password Policy Builder defaults to 16 characters for standard accounts and 20 for admin accounts — both exceeding all current UK guidance.

Does Cyber Essentials require two-factor authentication?

The updated Cyber Essentials scheme strongly recommends MFA for internet-facing services and cloud accounts. From the 2022 scheme update, MFA is effectively required for cloud services, remote access accounts, and administrator accounts. The technical control requirement — account lockout after maximum 10 attempts, or MFA — means organisations should implement MFA on all externally accessible systems.

Can we share passwords between team members?

Only via a designated business password manager's shared vault or collection feature — not by emailing, messaging, or writing down the password. Sharing via a password manager means access can be revoked, the credential appears in audit logs, and the password can be updated centrally. Cyber Essentials requires access control — shared credentials in uncontrolled media (email, spreadsheets) do not meet this requirement.

Should we rotate passwords regularly?

Current NCSC and NIST guidance advises against mandatory periodic rotation. Forced rotation leads to predictable incremental patterns (Password1, Password2) and typically results in weaker overall security. The current recommended policy is: change credentials immediately on any indication of compromise, when a staff member leaves, or when a vendor reports a breach — not on a fixed calendar schedule.

What is the NCSC Small Business Guide?

The NCSC Small Business Guide is a free resource from the UK National Cyber Security Centre aimed at businesses without a dedicated IT security team. It covers five priority actions: regular software updates, using strong and separate passwords for important accounts, turning on two-factor authentication, keeping backups, and protecting devices from malware. Password guidance recommends using three random words as the basis for memorable passwords and a password manager for all accounts.

What is a business password manager and which should we use?

A business password manager is a team-grade credential vault with centralised administration, shared collections with access controls, audit logging, and off-boarding workflows. Recommended options for SMEs: Bitwarden Business (~£5/user/month, open source, independently audited) and 1Password Teams (~£7.50/user/month, excellent onboarding). Both are Cyber Essentials compatible when properly configured with MFA on the manager itself.

Is this generator safe for generating work passwords?

Yes. All generation uses crypto.getRandomValues() — the browser's CSPRNG backed by OS hardware entropy. Nothing is transmitted to any server. Open browser DevTools (F12), navigate to the Network tab, clear entries, and generate a password — you will see zero network requests. No passwords are stored by this site. The generator is suitable for generating credentials before storing them in your business password manager.

What should our password policy say about remote working?

A remote working password policy should specify: all work credentials must be accessed via the company password manager (not the personal browser); MFA is required on all cloud services accessed remotely; work credentials must not be stored on personal devices outside the company password manager app; and the VPN or Zero Trust gateway must be used when accessing internal resources. The Work Password Policy Builder generates a paragraph covering these requirements.

How do we handle admin account passwords differently?

Administrator accounts require stronger credential controls than standard user accounts because compromise of an admin account gives an attacker full system access. Best practices: separate admin account from regular user account (never use an admin account for day-to-day email); longer generated passwords (20+ characters); MFA mandatory, FIDO2 hardware key preferred; admin credentials stored in a separate restricted vault in the password manager; admin account activity logged and reviewed regularly.

What happens to passwords when an employee leaves?

On the day an employee leaves: revoke their password manager access; change all shared credentials they had access to; disable their email account and SSO login; revoke MFA tokens; and retrieve or remotely wipe company devices. Cyber Essentials requires a defined off-boarding process — the leaver process should be documented and tested before it is needed. The Work Password Policy Builder generates an off-boarding requirement that can be added to the staff handbook.

💼 Cyber Essentials & NCSC Small Business Aligned

🖥️ Runs in your browser — nothing leaves your device

Password security
built for business.
Simple enough for everyone.

Generate strong work passwords and a ready-to-copy policy paragraph for your staff handbook. Live compliance indicators for Cyber Essentials, NCSC, and NIST SP 800-63B — no IT consultant required.

💼 Open Policy Builder Cyber Essentials guide →

🛡️

Cyber Essentials alignedPassword controls checked against the Cyber Essentials technical requirements in real time.

🔒

Nothing transmittedAll generation uses crypto.getRandomValues() in your browser. Zero data sent to any server.

📋

Policy paragraph includedCopy a ready-made staff handbook paragraph configured to your chosen settings.

🆓

Free for any businessNo sign-up, no account, no subscription. For SMEs who can't afford a security consultant for every decision.

💼 SOP-07 — Work Password Policy Builder

Generate passwords & build your policy

Client-side only · Zero transmission
crypto.getRandomValues()

💼 workpassword.net — password generator

Standard16 chars

Admin20 chars

Cloud20 chars

Remote24 chars

Select account type and generate

———

Length: 16

A–Z a–z 0–9 !@#

          ✓ crypto.getRandomValues() — OS entropy
✓ Zero network requests
✓ Nothing stored
        

Compliance & Policy Panel

✅

Cyber Essentials16 chars + all char classes — exceeds requirement

✅

NCSC Small Business GuideMeets NCSC recommendations for standard accounts

✅

NIST SP 800-63B 2025Exceeds 15-character minimum for standard accounts

ℹ️

MFA reminderCyber Essentials requires MFA or lockout on cloud & remote access accounts — password strength alone is not sufficient.

Ready-to-copy policy paragraph

Generate a password to see the policy paragraph.

Features

Everything a small business needs

🛡️

Cyber Essentials compliance

Live indicator checks your password settings against the Cyber Essentials technical requirements — no guesswork at assessment time.

📋

Policy paragraph generator

Copy a ready-made staff handbook paragraph, pre-configured to your settings, that documents your password policy for Cyber Essentials evidence purposes.

💼

Work-specific presets

Standard, Admin, Cloud, and Remote Access presets with appropriate length defaults for each account type — matching the threat level of each.

🔒

Client-side only

All generation uses crypto.getRandomValues(). Nothing transmitted. Suitable for generating credentials before adding to your business password manager.

Compliance Reference

Password requirements by standard

Standard	Min length	Complexity	Rotation	MFA
Cyber Essentials	Not specified (8+ recommended)	Not easily guessable	On compromise only	Required for cloud/remote
NCSC Small Business	8+ standard, 14+ admin	Generated preferred	On compromise only	Strongly recommended
NIST SP 800-63B 2025	15 characters	No mandatory complexity	On compromise only	Required at AAL2+
ISO 27001:2022	Policy-defined	Policy-defined	Risk-based	Recommended for privileged
Work Password (default)	16 standard / 20 admin	All 4 character classes	On compromise only	Implement separately

Tools for Your Business

More ways to manage work passwords

👥

New Hire Password Kit

Pre-configure credentials for new employees before day one. Generate work passwords, prepare MFA setup instructions, and add them to your password manager — all aligned with Cyber Essentials onboarding requirements.

Generate Kit →

🔍

Audit Fix Mode

Found policy violations in your last compliance audit? Use the Policy Builder to generate replacement credentials that meet Cyber Essentials standards, then update your policy paragraph for the re-assessment. Document the fix.

Fix Audit Issues →

📋

Contract Password Clause

Generate a compliance-ready password security clause for your vendor contracts and supplier agreements. Includes Cyber Essentials requirements, MFA obligations, notification timelines, and off-boarding terms.

View Clause Guide →

Recommended Tools

Implement your password policy

ℹAffiliate disclosure: Some links earn a commission at no cost to you. We only recommend tools suitable for UK SMEs. Full disclosure →

🗝️ Bitwarden Business

Open-source, independently audited. ~£5/user/month. Central admin console, shared collections, audit logging, and off-boarding workflows. Cyber Essentials compatible when configured with MFA.

Try Bitwarden →

1️⃣ 1Password Teams

Polished UI with excellent onboarding for non-technical teams. ~£7.50/user/month. Emergency Kit provides documented recovery process. Strong audit and access control features.

Try 1Password →

🛡️ Cyber Essentials via NCSC

The NCSC's free Cyber Essentials self-assessment tool and guidance documents — the definitive reference for UK SME security requirements. Start here before paying for assessment.

Cyber Essentials guide →

About

Written by an hobbyist with a keen interest in password security and online safety

Rachel Morris is an hobbyist with a keen interest in password security and online safety who has helped over 80 UK SMEs achieve Cyber Essentials and Cyber Essentials Plus certification. Her work focuses on making security requirements accessible to businesses without a dedicated IT security function — translating technical requirements into practical, cost-effective implementations.

All content aligns with the NCSC Small Business Guide, Cyber Essentials scheme, and NIST SP 800-63B 2025.

About Rachel Morris →

Trust Signals

✅

Cyber Essentials alignedCompliance panel checked against current Cyber Essentials requirements.

✅

Client-side generationcrypto.getRandomValues() only. Zero transmission. Nothing stored.

✅

Primary sources citedNCSC, NIST, Cyber Essentials scheme documentation.

✅

UK operatedKokal Operations Ltd, England & Wales. UK GDPR.

FAQ

Common questions from SMEs

Cyber Essentials does not mandate a specific minimum, but requires passwords are not easily guessable and that account lockout or MFA is in place. The NCSC recommends 8+ chars for standard accounts, 14+ for admin. Work Password defaults to 16 (standard) and 20 (admin) — both exceed all current UK guidance.

The updated Cyber Essentials scheme effectively requires MFA for cloud services, remote access, and admin accounts. The technical control requirement — account lockout after max 10 attempts, or MFA — means MFA is the practical standard for internet-facing systems. Password strength alone is not sufficient for cloud and remote access accounts.

Only via a business password manager's shared vault — not email, Slack, spreadsheets, or Post-its. Shared credentials in uncontrolled media do not meet Cyber Essentials access control requirements because access cannot be revoked and there is no audit trail. Password managers provide all three.

No — current NCSC and NIST guidance advises against mandatory rotation schedules. Forced rotation produces predictable patterns (Password1!, Password2!) and results in weaker security. Change credentials immediately on compromise indication, on staff departures, and when a vendor reports a breach — not on a fixed calendar.

Bitwarden Business (~£5/user/month, open source, independently audited) and 1Password Teams (~£7.50/user/month, excellent onboarding) are recommended for most UK SMEs. Both are Cyber Essentials compatible when configured with MFA on the manager itself. See our team password manager guide →

Yes. All generation uses crypto.getRandomValues() — the browser's CSPRNG backed by OS hardware entropy. Nothing is transmitted to any server. Open DevTools → Network → Clear → Generate to verify zero requests. Use the generated password to populate your business password manager.

A ready-to-copy paragraph describing your password policy based on the current generator settings — suitable for inclusion in a staff handbook, IT policy document, or Cyber Essentials evidence pack. It includes the minimum length, character requirements, use of the company password manager, and change requirements.

A free resource from the UK NCSC covering five priority security actions for businesses without a dedicated IT team: software updates, strong separate passwords, two-factor authentication, backups, and malware protection. Available free at ncsc.gov.uk. The starting point for any UK SME's security posture.

Admin accounts need: longer passwords (20+ chars vs 16 for standard), a separate account from the daily-use account, mandatory MFA — FIDO2 hardware key preferred, admin credentials in a separate restricted vault, and activity logging. Use the Admin preset in the generator for correct defaults.

On their last day: revoke password manager access; change all shared credentials they had access to; disable email account and SSO login; revoke MFA tokens; retrieve or wipe company devices. Document this as a written off-boarding checklist — Cyber Essentials requires a defined process. See our HR security checklist →