Password policy tester
Does your password meet NIST, OWASP, PCI DSS, or Active Directory rules? Check named policies and design your own.
Frequently asked questions
How is this different from the strength meter?
The strength meter estimates how hard your password is to crack (entropy, patterns, dictionaries). The policy tester tells you whether it satisfies concrete named rules (NIST 800-63B, OWASP ASVS, PCI DSS, Active Directory). A password can be very strong and still fail a badly designed policy — or pass a weak policy but be easy to crack. They are complementary tools.
Why don't NIST and OWASP require uppercase, digits, and symbols?
Because "composition rules" push users into predictable patterns (Password1!, Summer2024$) without adding real security. Modern guidance (NIST 800-63B, 2017) is: generous minimum length, no composition rules, and check against breach lists. Counterintuitive but research-backed: length > complexity.
Why does Microsoft AD still require 3 of 4 categories?
It's the historical default of Active Directory (predating modern guidance). Many enterprises still use it, so we include it so you can check whether your password would work in a classic corporate environment. Microsoft itself now recommends disabling this rule and using banned-password lists.
Is the password sent to any server?
No. Every check runs in your browser as plain JavaScript. No network calls, no history, no cookies. You can verify it in DevTools (Network tab) or by reading the source code.
Can I test my own policy?
Yes. Open the "Custom policy" section and configure length, per-category requirements, and restrictions (repeated chars in a row, sequential runs). Useful if you are designing a policy for your product and want to see how it behaves on real input before implementing it.