Security Analysis
Password Policy Tester
Before you publish a password rule set, test it. Configure the policy you plan to enforce, try realistic passwords against it, and see whether the rules push people toward strong secrets or just annoying ones.
At least 12 characters
Contains an uppercase letter
Contains a lowercase letter
Contains a digit
Contains a symbol
Not based on a very common password
No character repeated 3+ times in a row and no simple sequence
Enter a password to evaluate it against the policy above.
The password is evaluated in your browser only. It is never transmitted, stored or compared against any online breach service.
Designing a policy people can follow
- Modern guidance (NIST SP 800-63B) favours long passphrases and blocklists over forced character classes and rotation.
- Screen new passwords against breached-password lists -- that stops far more account takeovers than a symbol requirement.
- Drop mandatory 90-day expiry unless compromise is suspected; it mostly produces Password1, Password2, Password3.
- Allow long inputs and paste so password managers work, and pair everything with multi-factor authentication.
Related tools
Regex Tester
Test regular expressions against sample text with live match highlighting.
CVSS 3.1 Calculator
Build a CVSS v3.1 base score and vector string to prioritise vulnerabilities.
TOTP 2FA Code Generator
Turn a Base32 secret into live six-digit authenticator codes to test MFA enrolment.