Password compliance
certificate.
A password compliance certificate is a cryptographically signed, machine-verifiable proof that a credential was generated to a specific security standard. It is the difference between claiming your passwords are compliant and proving it to an auditor.
What is a password compliance certificate?
A password compliance certificate is a cryptographically signed document that attests to three facts about a credential: how it was generated (via a cryptographically secure pseudorandom number generator), what its entropy score is (in bits), and which security standard it satisfies (NIST 800-63B, HIPAA, PCI-DSS v4.0, SOC 2, ISO 27001, or FIPS 140-3).
Unlike a password manager entry or a generator log, a compliance certificate is independently verifiable. The certificate is an ES256-signed JWT. Anyone — including an auditor with no PassGeni account — can verify its authenticity via the public JWKS endpoint at passgeni.ai/.well-known/jwks.json. The plaintext credential is never included.
Password compliance certificate — A machine-readable, cryptographically signed attestation that a credential was generated using a CSPRNG, meets a minimum entropy threshold, and satisfies the documented requirements of a named security standard. Used as primary evidence in compliance audits.
PassGeni issues certificates for NIST SP 800-63B, HIPAA §164.312, PCI-DSS v4.0, SOC 2 CC6.1, ISO 27001 A.9.4.3, and FIPS 140-3.
Why password generators are not enough
A password generator is a production tool. A compliance certificate is an evidence tool. The distinction matters because every major compliance framework requires documented proof — not just implementation — of compliant credential management.
Here is what an auditor cannot determine from a password generator alone:
PCI-DSS v4.0 Requirement 12.3.2 — "A targeted risk analysis is performed for each PCI DSS requirement that provides flexibility in how the requirement is met." Flexibility does not mean skipping documentation. Requirement 8.3.6 evidence includes proof of generation method and entropy.
PassGeni's Credential Compliance Fixer and Strength Checker analyze existing credentials. The certification endpoint then issues the verifiable proof.
How password certification works
The certification process uses asymmetric cryptography. PassGeni generates credentials client-side using crypto.getRandomValues() — the Web Crypto API's CSPRNG implementation. The credential's SHA-256 hash (never the plaintext) is submitted to the certification endpoint.
The endpoint calculates entropy, checks standard compliance, and issues an ES256-signed JWT. The private key never leaves PassGeni's signing service. The corresponding public key is published at the JWKS endpoint for independent verification.
Audit relevance by framework
Every major security framework requires credential documentation. The following table shows what each standard requires and what a PassGeni certificate provides as evidence.
For detailed requirements per framework, see the compliance guides: HIPAA, PCI-DSS, SOC 2, ISO 27001, NIST 800-63B, FIPS 140-3.
Step-by-step: get your first certificate
The entire process takes under two minutes. No command line, no API key required for free credentials.
Certificates vs. password managers
Password managers and compliance certificates are complementary tools. Many organisations use Bitwarden, 1Password, or Dashlane for storage alongside PassGeni certificates for audit evidence. Here is how the responsibilities divide:
For an audit, your auditor needs both: your policy document (use PassGeni's Policy Generator), and per-credential proof (compliance certificates). The manager handles day-to-day storage; the certificate handles audit evidence.
Frequently asked questions
What is a password compliance certificate?
A password compliance certificate is a cryptographically signed document that proves a credential was generated to a specific security standard. It contains the credential's entropy score, generation method, applicable standard (NIST, HIPAA, PCI-DSS, SOC 2, ISO 27001, or FIPS 140-3), and an ES256 digital signature that auditors can independently verify via PassGeni's public JWKS endpoint.
Why can't auditors just trust that we have strong passwords?
Auditors are required to verify claims, not accept them. Under HIPAA, PCI-DSS, and SOC 2, documented evidence of compliant access controls is a mandatory requirement — not optional. A password compliance certificate is that evidence: cryptographic proof that the credential was generated correctly, not just a claim that it was.
Does the certificate contain my actual password?
No. PassGeni certificates never contain plaintext passwords. They contain a SHA-256 hash of the credential (for identity), the entropy score, the generation standard, and the digital signature. The plaintext credential is never transmitted to PassGeni's servers.
How long is a PassGeni certificate valid?
Certificates do not expire by default, but PassGeni allows you to set expiry dates on the Assurance and Authority plans. Auditors typically want certificates issued within the current audit period — issuing a new certificate after a credential rotation is best practice.
Which compliance frameworks accept PassGeni certificates?
PassGeni certificates are accepted as evidence for NIST SP 800-63B, HIPAA §164.312, PCI-DSS v4.0 Requirement 8.3.6, SOC 2 CC6.1, ISO 27001 Annex A.9.4.3, and FIPS 140-3. The certificate includes the specific standard and version so auditors can cross-reference requirements.
What is the difference between a compliance certificate and a policy document?
A password policy document (like those generated by PassGeni's Policy Generator) describes your organisation's rules for credential management. A compliance certificate is per-credential proof that a specific credential was generated according to those rules. Auditors need both: the policy to show intent, and certificates to show execution.
Can I generate certificates for existing passwords?
You can run existing credentials through PassGeni's Compliance Fixer to check whether they meet a target standard. If they do, a certificate can be issued. If they don't, PassGeni generates a compliant replacement and issues the certificate for the new credential.
Get your first certificate in 2 minutes.
Free for one credential. ES256-signed, auditor-verifiable, standard-specific. No credit card required.