Password Policy Tester
Score your existing or draft password policy against modern guidance — NIST SP 800-63B, the UK NCSC, and the CIS benchmarks — and get a graded gap report with recommended policy text.
Your policy settings
NIST: minimum 8; recommended 15+ for sensitive accounts.
NIST: must allow at least 64 characters.
NIST: allow all printable ASCII and Unicode; do not strip spaces.
Composition rules
NIST recommends against composition rules — they push users to predictable patterns. Length + denylist + breach check is more effective.
Rotation & lockout
NIST: don\'t force rotation. Rotate only on compromise.
NIST does not require, but blocking the last 5-10 passwords is sensible if you have rotation.
NIST 800-63B: rate-limit. Locking out forever creates a DoS vector; throttling is preferred.
Verification & storage
Authenticators & MFA
NIST: SMS is "restricted" — discouraged for high-risk accounts. FIDO2 / WebAuthn is the gold standard.
Why the modern approach is different
- Length over complexity: long passphrases beat short complex strings, both for users and for cracking time.
- No forced rotation: NIST and NCSC explicitly recommend against periodic password change. It increases user friction and predictable patterns.
- Block known-breached secrets: Have I Been Pwned-style range checks reject the passwords attackers will actually try.
- Lockout is a DoS vector: use rate-limiting and risk-based step-up instead.
- Phishing-resistant MFA: FIDO2 / WebAuthn passkeys are the most resilient to AiTM phishing kits today.
References: NIST SP 800-63B (rev 4), NCSC password guidance, CIS Benchmarks, Microsoft Password guidance.