Password Policy Tester

What this tool is used for

• Checking a proposed policy against realistic passwords before imposing it on users.
• Explaining to a stakeholder why a rule they want will push people toward predictable patterns.
• Verifying that an implementation's rules match the policy that was actually agreed.
• Testing whether a legacy policy would reject a modern passphrase, which is usually the real problem.
• Producing evidence for a review that a policy is or is not aligned with current guidance.

Frequently Asked Questions

Do composition rules actually help?

Less than they cost. NIST SP 800-63B stopped recommending them: forced symbols and digits push people to `Password1!`, which is predictable. The guidance now is length, a check against known-breached passwords, and no arbitrary character requirements.

How long should a password be?

NIST sets a minimum of 8 and recommends allowing at least 64, so passphrases are possible. Length beats complexity: four random words carry more entropy than eight mixed characters, and people can actually remember them.

Should passwords expire?

Not on a schedule. Forced rotation produces `Summer2026!` followed by `Autumn2026!`, which is worse than a strong password kept. Rotate on evidence of compromise — that is both the NIST and the NCSC position now.

What about spaces and Unicode?

Both should be accepted, and NIST says so explicitly — truncating or stripping them silently breaks a legitimate passphrase. Watch for one real limit that no policy can override: bcrypt truncates at 72 *bytes*, and an emoji costs four of them.

What matters more than the policy?

Storage and rate limiting. A weak password behind Argon2 hashing, breach-list screening, throttled attempts and a second factor is far safer than a baroque policy in front of a fast unsalted hash.

What does NIST actually recommend now?

Check candidate passwords against lists of known-breached and common values, allow long passphrases including spaces, and drop mandatory composition rules and scheduled expiry. The guidance shifted from making passwords look complex to making them genuinely unpredictable.

Common errors and gotchas

• Adding composition rules and expecting stronger passwords. They mostly produce predictable substitutions instead.
• Capping length. A short maximum is a strong signal the password is being stored badly, and it removes the one thing that helps.
• Forcing periodic expiry with no sign of compromise, which current guidance advises against because it degrades choices.
• Rejecting spaces or non-ASCII, which blocks passphrases and gains nothing.
• Enforcing a policy while skipping the check that actually matters — whether the password appears in a breach corpus.