Cyber Essentials Password Generator

Generate passwords that meet UK Cyber Essentials requirements. Bulk mode, CSV export, blocklist check — all in your browser.

By Mat at INLine Computers · 100% in your browser · Aligned with the Danzell question set

Generate Cyber Essentials compliant password(s)

Which Cyber Essentials route are you on?

Minimum 12 — recommended 14+ for headroom.
Up to 50 (useful for IT admins).
✓ Cyber Essentials v3.3 compliant

    Cyber Essentials needs more than just strong passwords

    A business password manager enforces uniqueness, MFA integration, and audit trails — all needed for v3.3 compliance. Disclosure: the links below are affiliate links — we may earn a small commission at no extra cost to you.

    NordPass Business Bitwarden Teams (free tier available)

    What Cyber Essentials v3.3 actually requires

    The April 2026 update (Danzell question set) tightened password rules. The headline numbers, in plain English:

    • 12 characters minimum for any user account where multi-factor authentication is enforced.
    • 14 characters minimum where MFA is not technically possible (rare under v3.3 — MFA is now mandatory on every cloud service that supports it).
    • Common breached password blocklist required where the 8-character legacy path is still in use.
    • Brute-force protection — accounts lock after no more than 10 failed attempts, or use throttling that has the equivalent effect.
    • No forced periodic password changes — these were dropped years ago and v3.3 doesn't reintroduce them. Change passwords when there's a reason (breach, suspicion, leaver).

    The full detail is in the Cyber Essentials password policy guide on this site, or directly from the NCSC and IASME.

    For IT admins: bulk password setup

    Active Directory / Entra ID

    Set the count to match your batch size, click Generate, download the CSV, and use it as input for New-ADUser with -AccountPassword set per row, or for the M365 admin centre's bulk add. Force a change at first logon for production accounts.

    Google Workspace

    Generate the count you need, paste the passwords into the Password column of the Workspace bulk-upload CSV template, and tick "Require password change at next sign-in" in the admin console.

    Frequently Asked Questions

    Cyber Essentials v3.3 (Danzell question set, live from 27 April 2026) requires user account passwords to be a minimum of 12 characters where multi-factor authentication is enforced, or 14 characters where MFA is not technically possible. Where the 8-character path is still used, organisations must also block common breached passwords using a deny list. Brute-force protection (account lockout or throttling) is required either way.

    The passwords generated here meet the length and character class requirements of Cyber Essentials v3.3 and are checked against a blocklist of the 25 most commonly breached passwords. Compliance is also a function of how the password is used — your organisation must enforce MFA where available, prevent reuse, and have a process for password resets. The generator is one piece of the policy, not the whole policy.

    The Cyber Essentials minimum with MFA is 12, but 14 gives you a safety margin if requirements tighten or if a particular system has additional checks. Adding two characters costs nothing in usability when you're storing the password in a password manager — which the NCSC recommends anyway.

    Yes. Set the 'Number of passwords' field up to 50, click Generate, and download the result as a CSV. The file format is suitable for Active Directory, Microsoft 365 / Entra ID, or Google Workspace bulk import. All generation happens in your browser — the passwords are never sent to any server.

    NCSC three-random-words passphrases are an excellent route to compliance — a typical three-word passphrase runs to 16-24 characters which clears both the with-MFA and without-MFA minimums. Use our Three Random Words Generator if you prefer that style. The character generator on this page is the right choice when password managers will store the credential and human memorability isn't required.