Password Policy Evaluator
Test any password against NIST SP 800-63B guidelines. We check length, entropy, common-password exposure, keyboard patterns, sequential characters, and estimate real-world crack time, all without sending your password anywhere.
Passwords are evaluated entirely in your browser. Nothing is transmitted.
Type a password above to see a real-time strength analysis. Try common patterns like qwerty123! or a passphrase like CorrectHorseBatteryStaple to see the difference.
NIST 800-63B Compliance Checks
Length (NIST recommends 8 minimum, 12+ preferred)
Too short
Not in top 10,000 common password list
Enter a password to check
Character variety (mixed case, digits, symbols)
0 of 4 categories used
No keyboard patterns (qwerty, 123456, etc.)
Enter a password to check
No excessive repeating characters (aaa, 1111)
Enter a password to check
No sequential characters (123, abc)
Enter a password to check
Not a single dictionary word
Enter a password to check
NIST SP 800-63B Password Guidance
Do (NIST Recommended)
- Allow long passphrases (20+ characters)
- Accept all printable ASCII and Unicode
- Remove complexity rules (must include uppercase, symbol, etc.)
- Block common passwords and dictionary words
- Require MFA for sensitive accounts
Don't (NIST Discouraged)
- Mandate periodic password rotation
- Require character composition rules
- Use knowledge-based security questions
- Allow passwords shorter than 8 characters
- Allow unlimited failed login attempts
Recommended Training
Password, MFA & Account Security
Passkeys, password managers, and MFA fatigue attacks
Strong policies are useless if employees ignore them. This course trains passphrases, password managers, and MFA fatigue defense.
Free to use this tool, no signup required. Training is billed per seat, annually.