Password Policy Checker
Test a password against a configurable length/complexity policy, rule by rule.
Password policies are where good intentions become weak passwords. Complexity requirements push everyone toward the same predictable shapes, and forced rotation makes people iterate a number on the end. This page lets you test a candidate against a policy and see what the policy is really buying you.
How to use it
- Enter a password to check.
- Set the minimum length and toggle the uppercase, digit and symbol requirements.
- See which rules pass and which fail.
What to take away
Modern guidance moved away from complexity
NIST SP 800-63B now recommends longer minimums, screening against known-breached passwords, and dropping composition rules and scheduled expiry — because both demonstrably make passwords worse.
Blocklists beat rules
Checking a candidate against known-breached passwords stops far more account takeovers than any arrangement of character-class requirements.
Rotation without cause is counterproductive
Forcing 90-day changes produces Summer2024! then Autumn2024!. Rotate on evidence of compromise instead.
Frequently asked questions
What does NIST actually recommend now?
A minimum of 8 characters and support for at least 64, screening against breach corpora, no composition rules, and no periodic expiry unless there is evidence of compromise.
Should I require a symbol?
It buys very little. Users satisfy it with a trailing ! that every cracking ruleset tries first. Length plus a breach blocklist is a far better use of the same friction.
Is my password sent anywhere?
No. The check runs entirely in your browser. Even so, test with a variation rather than a password you actually use.
Where this fits in the course
This security tool pairs with Path 00 — Absolute Basics — see all 26 learning paths.
It runs entirely in your browser: nothing is uploaded, no account is needed, and it is free.
Related
- Password Strength — Rough entropy and crack-time estimate for a password, with feedback.
- Password Cracking Lab — Four hashed passwords, one wordlist. See exactly which ones fall to a dictionary attack and which survive it — and why.
- Entropy Calculator — Shannon entropy of any text — a genuine static-analysis signal for spotting packed or encrypted data.
- Compliance Control Mapper — Look up how one control area maps across SOC 2, ISO 27001, NIST 800-53, and PCI-DSS.