Introduction
Most data breaches start with a weak password. A password policy checker tells you, in real time, whether a password would survive an offline attack before you ship it to a database. Instead of guessing whether "Summer2024!" passes your corporate rules, you type it in and watch each rule light up green or red. The tool estimates entropy in bits and converts that into an estimated crack time at 10 billion guesses per second, the speed of a modern GPU rig. Developers use it to tune signup forms, sysadmins use it to audit default credentials, and security trainers use it to show students why length beats complexity. Everything runs in the browser, so the password you test never travels anywhere.
What this tool does
- Validates a password against a configurable policy: minimum length, uppercase, lowercase, digits, and special characters.
- Rejects passwords that exceed a configurable limit of consecutive repeated characters (for example, aaa or 1111).
- Checks the password against a built-in list of roughly 100 common passwords including password, 123456, qwerty, and admin.
- Detects keyboard and alphabetical sequences like abcd, 1234, and qwerty that attackers try first in dictionary attacks.
- Estimates entropy in bits from the character pool size and length, then converts it to an estimated offline crack time.
- Updates every check in real time as you type, with a green check or red x icon next to each rule.
How this tool works
The checker runs entirely in your browser with no network calls. You type a password into a masked field with a show/hide toggle. As you type, the tool evaluates the password against every enabled rule and renders a checklist with pass or fail indicators. The default policy requires 12 characters, uppercase, lowercase, digits, special characters, no more than 3 consecutive repeated characters, no common passwords, and no sequences. You can toggle each rule on or off and adjust the minimum length and repeat limit to match your organization's policy. Entropy is estimated as length times log2 of the character pool size, where the pool grows by 26 for lowercase, 26 for uppercase, 10 for digits, and 33 for symbols. The crack time estimate assumes an offline attack at 10 billion guesses per second and divides the keyspace by two for the average case. Failure reasons are listed explicitly so a user knows exactly which rule they missed.
How password strength and entropy are measured
Password strength is not a single number. It is the product of length and the size of the character pool the attacker must search. A 12-character password drawn from 95 printable ASCII characters offers roughly 79 bits of entropy, while a 12-character password using only lowercase letters offers about 56 bits. NIST SP 800-63B (Digital Identity Guidelines, 2017) moved away from mandatory complexity rules and toward length and breach-list checking, because users respond to forced complexity with predictable patterns like Password1!.
The OWASP password recommendations echo this: enforce a minimum length of 8 characters (12 or more is better), screen against known compromised passwords, and avoid forced periodic rotation. This tool implements both philosophies. It checks length and character classes for legacy policy compliance, but it also screens against a common-password list and detects sequences, which catches the patterns NIST warns about. The entropy and crack-time estimates give you a second signal beyond pass or fail, so you can see that a 20-character passphrase of only lowercase letters can beat an 8-character password full of symbols.
How to use this tool
- Type or paste the password you want to test into the input field. Use the eye icon to reveal it if needed.
- Review the policy settings card and adjust the minimum length, character class requirements, repeat limit, and sequence or common-password checks to match your rules.
- Watch the checklist update in real time. Each rule shows a green check when it passes and a red x when it fails.
- Read the failure reasons list if any rule fails. It names the exact problem, like no uppercase letter found.
- Check the entropy estimate in bits and the estimated crack time to gauge overall strength beyond pass or fail.
- Adjust the password until every enabled rule passes and the crack time meets your risk tolerance.
Real-world examples
Tuning a signup form policy
A frontend developer is building the password field for a SaaS signup form. She sets the minimum length to 12, enables all character classes, and turns on common-password rejection. She tests Summer2024! and sees it passes the character rules but the entropy reads only 71 bits. She then tests correct-horse-battery-staple and sees it passes with 91 bits despite having no digits or symbols. She lowers the minimum length to 10 and drops the special-character requirement, relying on length and the common-password list instead, which aligns with NIST SP 800-63B.
Auditing default service passwords
A sysadmin inherits a fleet of devices with default credentials. He pastes admin and sees it flagged as a common password. He pastes P@ssw0rd and sees the same. He pastes 12345678 and sees it flagged as a sequence and too short. The tool gives him a concrete list of reasons to send to the vendor, citing the exact rules each default password violates, so the remediation request is unambiguous.
Teaching why length beats complexity
A security trainer asks a class to test two passwords. The first, Tr0ub4dour&3, passes every complexity rule but cracks in an estimated 3 minutes at 10 billion guesses per second because it is only 11 characters. The second, correct horse battery staple, fails the digit and symbol rules but cracks in an estimated 550 years because it is 28 lowercase characters. The trainer uses the side-by-side entropy numbers to show why NIST SP 800-63B favors length over forced complexity.
Comparison with similar methods
| Method | Complexity | Typical use |
|---|---|---|
| Length-only policy | Low enforcement cost | NIST-aligned, user-friendly, relies on breach lists |
| Complexity policy (upper, lower, digit, symbol) | Medium enforcement cost | Legacy compliance, PCI DSS, older standards |
| Breach-list screening | Medium (requires a list) | NIST SP 800-63B recommendation, blocks known leaked passwords |
| Entropy and crack-time estimate | Low (computed from pool size) | User education, showing strength beyond pass or fail |
Limitations or considerations
The entropy estimate is a mathematical upper bound based on the character pool and length. It assumes the password was chosen uniformly at random, which human-chosen passwords rarely are. A password like Password123! scores well on entropy but fails the common-password and sequence checks, which is why both signals matter. The common-password list contains roughly 100 entries and is not a full breach corpus like Have I Been Pwned; for production screening, query a real breach database. The crack-time estimate assumes 10 billion guesses per second, a reasonable offline GPU rate today, but hardware improves. The tool does not store, hash, or transmit any password you type. It is a client-side checker, not a password manager.
Frequently asked questions
What entropy score should I aim for?
Anything above 80 bits is strong for a user password. Above 120 bits is very strong. Below 60 bits is weak and will fall to an offline attack in hours or less.
Does NIST still require special characters in passwords?
No. NIST SP 800-63B (2017) dropped mandatory complexity rules in favor of minimum length (8 characters minimum, 12 or more recommended) and screening against known compromised passwords.
How is the crack time calculated?
The tool takes the entropy in bits, computes 2 to that power as the keyspace, divides by two for the average case, and divides by 10 billion guesses per second to model a modern offline GPU attack.
Is my password sent anywhere when I use this tool?
No. All checks run in your browser. The password never leaves your device, is never stored, and is never hashed on a server.
Why does a long lowercase password beat a short complex one?
Entropy grows with length times log2 of the pool size. A 28-character lowercase passphrase has more entropy than an 11-character password using all character classes, because length multiplies faster than pool size adds.
Conclusion
Run any password through this password policy checker before you store it. Adjust the rules to match your standard, watch the checklist go green, and use the entropy and crack-time numbers to compare candidates. Pair length with breach-list screening and you land on the approach NIST SP 800-63B and OWASP both recommend, without forcing users into predictable complexity patterns.