Password to test

Your password

Stays in this browser tab. It is never sent, stored or remembered.

Nothing to test yet. Start typing above and every rule appears here, each one marked met or not met, alongside how strong the password actually is.

The policy to test against

Start from

NIST 2024Classic complexityStrictCustomWhatever you set below

What the current US government guidance asks for: length, and almost nothing else. It advises against forcing a mix of character types, because it pushes people towards predictable substitutions rather than longer passwords.

Minimum length15

4 characters64 characters

The one rule that does the most work. Everything below it is decoration by comparison.

The password must contain

A lowercase lettera through zAn uppercase letterA through ZA number0 through 9A symbolPunctuation such as ! @ # $

The password must not contain

SpacesSome older forms reject themObvious runs4 in a row like abcd, 4321 or qwertyA length capTest against a form that limits lengthRepeated charactersCap runs of the same character

What a password policy can and cannot tell you

A policy is a set of rules a password has to fit: how long it is, which kinds of characters it contains, what it must not contain. Every rule is about the shape of the password, which is the only thing a login form can check quickly — and the reason a policy is a weaker guarantee than it looks.

P@ssw0rd satisfies the classic corporate rule set completely: eight characters, upper, lower, a number and a symbol. It is also one of the first passwords any attacker tries. Composition rules are easy to satisfy predictably, and that is exactly what people do under one — a capital at the front, a number and an exclamation mark at the end.

This is why the current NIST guidance dropped them. It asks for length, asks that long passwords and passphrases be accepted, and advises against forcing a mix of character types or expiring passwords on a schedule. The remaining requirement it does make — that a password be checked against lists of ones already breached — is not something a rule about shape can do, which is what the strength checker is for.

So read the two verdicts above together. The checklist tells you whether a form will accept this password; the meter tells you whether it should.