Password Policy Compliance Checker

The guidance reversed and most policies did not

NIST SP 800-63B abandoned mandatory periodic rotation and composition rules years ago, on the evidence that both make passwords weaker rather than stronger. Forced rotation produces predictable increments, and composition rules push users toward the same handful of substitutions. The current guidance is the opposite of what most corporate policies still say: long minimums, no forced expiry without evidence of compromise, no character-class requirements, and a check against known-breached passwords.

Standards now disagree with each other

PCI DSS 4.0 moved toward NIST but not all the way, requiring a 12-character minimum and retaining 90-day rotation unless dynamic risk analysis is performed instead. An organisation subject to both has to satisfy the stricter of two rules that point in different directions, which is why a policy usually needs to be written against a specific standard rather than against good practice in the abstract. This tool reports each standard separately rather than blending them into a single verdict.

Blocklists do more than any length rule

Checking a proposed password against a list of known-breached and obviously weak values removes far more real risk than adding a character class. Credential stuffing works because people reuse passwords that already appear in public breach corpora; length and complexity rules do nothing against that, and a blocklist does. It is the single most effective requirement in the current guidance and the one most often left unimplemented.

Related tools

• SOC 2 Evidence Readiness — Interactive checklist to gauge your SOC 2 evidence readiness.
• Privacy Policy Checker — Check if your policy covers standard requirements (GDPR/CCPA basics).
• Compliance Req Finder — Find which standards (ISO, SOC2, HIPAA) apply to your industry/region.
• Audit Readiness Planner — Plan your compliance audit timeline (SOC2, ISO) backwards from deadline.