OneTaskBy Tim King · Updated
Password Policy Tester
Test Passwords Against Length, Character, Repeat and Banned-Word Rules, With Reasons
OneTask is free, with no sign-up, and built by one person.
If this tool saved you time, a coffee helps keep new ones coming.
How the Password Policy Tester works
This password policy tester checks a list of passwords against the rules you set, one password per line, and shows which pass and exactly why each failure fails. Use it to try out a policy before you ship it, or to explain to users what your sign-up form expects.
How the password policy tester applies each rule
Every password is checked against the minimum and maximum length, the number of character types it contains (lowercase, uppercase, digits and symbols), the longest run of one repeated character, a list of banned words, and the username. Banned words and the username are matched case-insensitively anywhere in the password, so "Acme2026!" fails if "acme" is banned. Length is counted in characters, so an emoji or accented letter counts as one.
What a modern policy looks like
NIST SP 800-63B recommends a minimum of at least eight characters, and preferably fifteen, allowing at least 64, no forced mix of character types, and screening against breached and common passwords. Composition rules tend to produce predictable patterns like "Password1!" that pass the rules but fall to the first guesses an attacker tries. Try both kinds of policy here and compare what they let through.
FAQ
Should I require symbols and numbers?
Current guidance says no. Composition rules push people toward predictable substitutions and a symbol on the end, which attackers model. A longer minimum length combined with a banned list and a breach check blocks weak passwords more effectively and is easier for people to live with.
What belongs in the banned list?
Your product and company names, the site's domain, obvious seasonal words, and the most common passwords such as "password", "qwerty" and "letmein". Keep it focused; the breach check catches the long tail of leaked passwords far better than a hand-written list ever could.
Are the passwords I paste sent anywhere?
No. Every rule is checked in your browser, and nothing leaves the page. You can safely test a sample of real passwords, though for a production audit you should use hashes and your own tooling instead of the plaintext values.
See also: all Security & Identifiers tools, Dev Utilities, Formatters & Validators, Data & Encoding, SEO, Accessibility, AI.
Related tools
Password Strength Checker
Estimate a password's entropy, crack time and weak patterns.
Pwned Password Checker
Check a password against breach data without sending the password.
Password Generator
Strong random passwords generated in your own browser.
Passphrase Generator
Diceware passphrases from the EFF wordlist, generated locally.
Bcrypt Cost Benchmark
Time bcrypt cost factors and pick one that fits your login budget.