15-Character Password Generator
Generate a strong 15-character password — the minimum NIST now requires for a password used on its own.
Generate a 15-Character Password
Need a 15-character password? The generator above makes one instantly, using cryptographic randomness in your browser — nothing is sent to a server. If a site rejects some symbols, turn Symbols off and generate again. Click the password to copy it, or share it as a one-time link. With all four character types, 15 characters gives about 98 bits of entropy, far beyond any realistic brute-force attack. It is also the minimum NIST SP 800-63B-4 sets for a password used without a second factor.
Why 15 characters matters for enterprise security
The 15-character mark has a history in Windows. The old LM (LAN Manager) hash can only represent passwords of up to 14 characters, and it is trivially weak: it upper-cases the password and splits it into two 7-character halves that are cracked separately. A password of 15 characters or more cannot be stored as an LM hash at all, so older Active Directory environments used 15 as the length that guaranteed no LM hash existed. Windows has not stored LM hashes by default since Vista and Server 2008, but many enterprise policies kept the 15-character rule.
Compliance standards and 15-character passwords
NIST SP 800-63B-4 (2025) requires at least 15 characters for a password used as the only authentication factor, and at least 8 when the password is one part of multi-factor authentication. PCI DSS 4.0 requires user passwords of at least 12 characters (requirement 8.3.6). CIS Benchmarks for Windows recommend a minimum password length of 14 or more. SOC 2 does not set a password length; auditors check that you follow your own documented policy. A 15-character password meets the length minimums of all of these, but a policy can add other rules, such as banned-password lists or required character types, so check yours.
Sites that ask for "minimum 11 to maximum 15 characters"
Some sign-up forms show the message "Password must be minimum 11 to maximum 15 characters". A password from this generator fits that rule at the longest length it allows: 15 characters, with a capital letter, a small letter, a number and a symbol. Any length from 11 to 15 passes, so move the slider down if you prefer a shorter one. Other sites set only the upper limit: Indian Railways' IRCTC booking site, for example, caps passwords at 15 characters (as of October 2026 its sign-up form does not accept a 16th). If a site rejects a particular symbol, turn Symbols off and generate again.
How 15 characters compares to other lengths
With all character types (94 per position): 12 characters gives 78 bits of entropy. 14 characters gives 91 bits. 15 characters gives 98 bits. 16 characters gives 105 bits. The jump from 12 to 15 makes the password about 1 million times harder to crack. Compared to 16, you sacrifice 7 bits — negligible in practice. If your policy requires exactly 15, you're in excellent security territory. If you have flexibility, 16 is marginally better but 15 is already well beyond any realistic attack.
Frequently asked questions
- Why choose exactly 15 characters?
- Because many policies ask for it. NIST SP 800-63B-4 sets 15 characters as the minimum for a password used on its own, and in older Windows domains 15 was the length that stopped the weak LM hash from being stored. With all character types, 15 characters gives about 98 bits of entropy — effectively uncrackable by brute force.
- Is 15 characters better than 14?
- Marginally. Each additional character adds about 6.5 bits of entropy with all character types. The jump from 14 (91 bits) to 15 (98 bits) makes the password about 100 times harder to crack. If your policy requires 15, use 15. Otherwise, any length from 12-20 is strong.
- What compliance standards require 15-character passwords?
- NIST SP 800-63B-4 requires at least 15 characters for single-factor passwords. Others set lower minimums: PCI DSS 4.0 asks for 12, and CIS Benchmarks for Windows recommend 14 or more. SOC 2 sets no length and relies on your own policy. A 15-character password meets all of these minimums.
- What does "minimum 11 to maximum 15 characters" mean?
- The site accepts passwords that are 11, 12, 13, 14 or 15 characters long and rejects anything shorter or longer. Use 15: it is the strongest password the rule allows.
- Does this work for an IRCTC password?
- Yes. IRCTC's sign-up form accepts at most 15 characters, and current guides to its rules ask for a capital letter, a small letter, a number and a special character. A 15-character password generated here with every character type on has all of them. If the form rejects a symbol, turn Symbols off and generate again.
- Can I use this for my work or corporate account?
- Absolutely. This generator creates passwords meeting most corporate policies — mixed case, numbers, symbols, and 15 characters. The password is generated in your browser and never sent to any server, making it safe for sensitive corporate accounts.