Password Policy Tester
Score your existing or draft password policy against modern guidance — NIST SP 800-63B, the UK NCSC, and the CIS benchmarks — and get a graded gap report with recommended policy text.
Your policy settings
NIST SP 800-63B-4 (2025): ≥ 15 for single-factor passwords; ≥ 8 when the password is part of MFA. CIS: ≥ 14 without MFA.
NIST SP 800-63B-4: should permit at least 64 characters. NCSC: avoid maximum-length caps.
NIST: allow all printable ASCII and Unicode; do not strip spaces.
Composition rules
NIST recommends against composition rules — they push users to predictable patterns. Length + denylist + breach check is more effective.
Rotation & lockout
NIST: don\'t force rotation. Rotate only on compromise.
NIST does not require, but blocking the last 5-10 passwords is sensible if you have rotation.
NIST 800-63B: rate-limit. Locking out forever creates a DoS vector; throttling is preferred.
Verification & storage
Authenticators & MFA
NIST: SMS is "restricted" — discouraged for high-risk accounts. FIDO2 / WebAuthn is the gold standard.
Why the modern approach is different
- Length over complexity: long passphrases beat short complex strings, both for users and for cracking time.
- No forced rotation: NIST and NCSC explicitly recommend against periodic password change. It increases user friction and predictable patterns.
- Block known-breached secrets: Have I Been Pwned-style range checks reject the passwords attackers will actually try.
- Lockout is a DoS vector: use rate-limiting and risk-based step-up instead.
- Phishing-resistant MFA: FIDO2 / WebAuthn passkeys are the most resilient to AiTM phishing kits today.
Sources: NIST SP 800-63B-4 (final, Aug 2025), UK NCSC password guidance, CIS Password Policy Guide + CIS Controls v8 §5.2, OWASP Password Storage Cheat Sheet, and CISA phishing-resistant MFA.
Scope & limits. This scores the policy settings you enter against published guidance; it does not inspect any live system, test real passwords, or constitute a formal compliance attestation. Section numbers refer to NIST SP 800-63B-4 (rev 4 renumbered them from rev 3).