Password Policy Tester

Enter your organisation’s password policy settings — minimum length, complexity rules, expiry period, lockout threshold, and MFA status. The tool scores your policy 0–100 and compares it against four industry standards.

NIST 800-63B, CIS Controls v8, Microsoft’s own recommendations, and the Australian Essential Eight. Each standard has different approaches to password security.

Research shows forced expiry leads users to choose weaker passwords and make predictable changes (Password1 → Password2). NIST recommends longer passwords without expiry, combined with MFA.

Yes! Adjust any slider or toggle and see the score update in real-time. This helps you prioritise which policy changes will have the biggest security impact.

No. Everything runs 100% in your browser. No data is sent to any server. Your policy settings never leave your device.

Yes! This is V1 and we’d love your feedback. Visit our feedback page to suggest improvements.