Password Policy Tester
Switch on the rules your system uses, type a password, and see which pass and which fail, with the reason for each.
Worked examples
A workplace policy
Rules: 12 characters, 3 kinds, no well-known password, no user name. Password: ann1234abc for user Ann Smith.
Fails: too short (10), only 2 kinds of character, a run 1234 is not banned here, and it contains the name ann
A longer password with unrelated words passes all of these.
About Password Policy Tester
Anyone who designs a sign-up form, writes an IT policy or reviews an audit finding has to decide what makes a password acceptable. The wording is easy to write and hard to picture: what does at least 3 of 4 character types actually allow? This tester makes the rules visible. Turn on the rules your system uses, type a password, and every rule shows pass or fail with the reason.
You can set the shortest and longest length, require capitals, small letters, numbers and symbols or a minimum number of those kinds, limit repeated characters, ban runs such as abcd or 4321, keep the user name out of the password and block well-known passwords and their simple variations. Example policies, from modern length and blocklist only advice to a strict and an old style rule set, give you somewhere to start. Meeting a policy is not the same as being hard to guess, and the notes under the results say so.
How to use Password Policy Tester
- Choose an example policy, or set each rule yourself.
- Enter a user name or email if you want to test the rule that keeps it out of the password.
- Type a password to test. Tick Show the password if you want to see what you type.
- Read the table to see which rules passed and why any failed.
Common uses
- Designing the password rules for a new sign-up page
- Explaining a password policy to staff with examples
- Checking that your own system enforces the rules it claims to
- Comparing how strict two different policies really are
Frequently asked questions
Does passing the policy mean the password is strong?
No. A password such as Summer2026! passes many policies and is easy to guess. Length and unpredictability matter more than rules about character types.
What does current advice say about complexity rules?
The UK National Cyber Security Centre and standards such as NIST SP 800-63B advise against forcing mixtures of character types and regular changes. They favour longer passwords, checking against lists of known bad passwords, and allowing password managers. The first example policy follows that approach.
How does the well-known password check work?
It compares the password, ignoring capitals, with a short list of the most common passwords, and also checks a common password followed by a few digits or symbols. It is a quick check and not a replacement for a large list of breached passwords.
How are characters counted?
Length counts characters as people see them, so an emoji counts as one. Capitals and small letters include letters from other alphabets, and a symbol is any character that is not a letter, a number or a space.
Is the password I type sent anywhere?
No. The test runs on this page as you type. Even so, do not type a password you use for a real account into any tool. Use an example.