Tool
What the Password Policy Checker does
Password Policy Checker: checks Rules passed from Password. Example: password Summer2024 gives rules passed 5/7.
From Password, this tool derives Rules passed. The result recalculates on every keystroke without a button press or a page reload.
It is mostly used by people rotating an API key. Randomness quality matters here in a way it does not for most tools.
The work is done by JavaScript already loaded in your browser, so your input never crosses the network.
The method, a field-by-field reference and a worked example built from the defaults are all on this page.
What do the Password Policy Checker fields mean?
The Password Policy Checker uses 1 input. The form opens pre-filled, so the fastest way in is usually to overwrite the one field you actually care about.
| Field | What to enter | Default |
|---|---|---|
| Password | required | Summer2024 |
How does the Password Policy Checker work?
Each output is derived from the inputs above in a single pass; there is no hidden state carried between runs, so the same inputs always give the same check.
The guard clauses run before the formula does, which is why mistakes surface next to the field.
Worked example
These are the values the Password Policy Checker loads by default, and the result it produces from them. These are the tool’s own default values and the result they produce, not an invented illustration.
| Password | Summer2024 |
|---|
| Rules passed | 5/7 |
|---|
Composition rules versus what actually predicts strength
This checker scores a password against seven traditional composition rules: length, character classes, and a small blocklist. Current guidance (NIST SP 800-63B) has moved away from most of these, because they shape human behaviour in predictable, exploitable ways.
| 12+ characters | Catches very short passwords | A 12-character password can still be a common phrase |
|---|---|---|
| Upper, lower, digit, symbol | Catches single-class passwords | "Password1!" passes every rule and is still guessed in seconds |
| No obvious sequence | Catches qwerty, 1234, abcd | Misses sequences not on the checked list |
| Not a common word | Checks a small fixed list | Misses anything common that is not on that specific list |
Worth knowing
- A policy score is not the same as an entropy score, and neither is the same as real-world crackability: this page and the strength checker deliberately show both, because they can disagree on the same password.
- NIST SP 800-63B’s current recommendation replaces composition rules with two different things: a generous minimum length (8, ideally allowing up to 64) and a check against lists of known-breached passwords, a different and more effective filter than counting character classes.
- Forced composition rules push real users toward predictable patterns (capitalise the first letter, append a digit, end with a symbol), which is precisely the pattern cracking dictionaries are built to try first.
Read next: What Actually Makes a Password Strong
How to use it
- Fill in Password.
- Live output means you can search for a target value by nudging an input up and down.
- The panel reports Rules passed.
- Both Copy Link and Print capture the current state, so pick whichever suits how you file things.
What this tool does not do
- Randomness comes from your browser cryptographic source, which is suitable for real secrets.
- Randomness comes from your browser's cryptographic random source, which is suitable for passwords and keys.
- It applies one method. If your situation calls for a different convention, the answer will not match.
Frequently asked questions
Password. That is the whole form. A starting value is in place for each, which means a single edit is enough to get a meaningful answer.
With the values loaded when the page opens, rules passed comes out as 5/7. It recalculates the moment an input changes, which makes comparing scenarios quick.
No. The value is created locally from your browser cryptographic random source and is never sent to us.
It costs nothing, and there is no limit on repeat use.
Reliable for the case described. Where more than one convention exists, the method section says which one is used.