Password Policy Validator
Validate a password against NIST SP 800-63B-4, OWASP ASVS, PCI DSS v4.0 or your own rules: length, character types, repeats, blocklist, username.
0 = no maximum
Out of uppercase, lowercase, digits, symbols (0 = off).
0 = off
0 = off
NIST SP 800-63B-4: at least 15 characters for passwords used as the only factor (8 when used with MFA), allow at least 64 characters, no composition rules, and reject passwords found in blocklists of common or breached passwords.
Loading dictionaries…
What is Password Policy Validator?
Pick a policy preset or define your own rules, then type a password to see exactly which rules it passes and which it fails. Presets cover NIST SP 800-63B-4, OWASP ASVS 4.0, PCI DSS v4.0 and classic complexity rules.
How to use Password Policy Validator
- Choose a Policy preset or adjust the rules; changing any rule switches to Custom.
- Optionally enter a Username to check the 'no username' rule.
- Type the password into the Password field.
- Read the summary and the ✓/✗ list of rules.
Example
PCI DSS v4.0 preset, password password123
Fails 1 of 3 rules. ✗ At least 12 characters, ✓ Contains a letter, ✓ Contains a digit (0–9)
When to use Password Policy Validator
Use it to test whether a password satisfies a specific organisation's rules or to compare policies. It checks rules only; a password that passes can still be weak or breached.
How Password Policy Validator works
Each active rule is evaluated independently: length in Unicode characters against minimum/maximum, presence of uppercase, lowercase, letters, digits and symbols (any non-alphanumeric character), the number of character categories, the longest run of identical characters, the number of distinct characters, spaces, a lookup in the zxcvbn-ts common-password list and a case-insensitive username match.
Common Use Cases
- Checking a password against PCI DSS before setting it on a payment system
- Comparing NIST and classic complexity rules
- Testing edge cases while implementing a password policy
- Explaining to users why their password was rejected
FAQs
What does NIST SP 800-63B-4 require?
At least 15 characters for passwords used as the only factor (8 with MFA), allowing at least 64 characters, no composition rules, and rejecting passwords on blocklists of common or breached passwords.
What does PCI DSS v4.0 require?
Requirement 8.3.6: at least 12 characters (8 if the system cannot support 12) containing both numeric and alphabetic characters.
Why are composition rules discouraged?
They push people towards predictable patterns like Password1!, while adding little real strength. Length and blocklists work better.