Password Policy Checker

Introduction

Your organization requires 8 characters, one uppercase, one number, and one special character. Congratulations — you've just described 'Summer2024!', a password that meets every rule and takes 3 seconds to crack. The Password Policy Checker tests your credentials against real organizational policies and reveals the gap between compliance and actual security. It shows you exactly how your password performs under NIST, PCI-DSS, HIPAA, and custom policy frameworks — and where those policies fail to protect you.

What This Tool Does

A password policy checker is a tool that evaluates passwords against predefined organizational or regulatory requirements, verifying compliance with rules like minimum length, character class composition, maximum age, and breach database checks. Unlike strength checkers that measure entropy, policy checkers measure whether a password meets specific administrative requirements defined by frameworks like NIST 800-63B, PCI-DSS, HIPAA, and SOC 2. The tool reveals the critical distinction between policy compliance and actual security — a password can pass every policy rule while remaining trivially crackable if it follows common patterns.

Why It Matters

How It Works

The checker loads predefined policy templates for each framework: NIST 800-63B (min 8 chars, no composition rules, breach check required, no max age), PCI-DSS (min 7 chars, all four character classes, 90-day rotation), HIPAA (min 8 chars, upper+lower+digit, 90-day rotation), and custom policies with user-configurable rules. For each policy, the tool evaluates: length requirements (minimum and maximum), composition rules (required character classes), breach database lookup (checking against known leaked passwords), and pattern restrictions (banning common patterns). The output shows both compliance status (pass/fail with specific violations) and actual entropy, revealing when a compliant password is still weak.

Step-by-Step Examples

Code Examples

function checkPasswordPolicy(password) {
  const policies = {
    nist: { name: 'NIST 800-63B', minLength: 8, maxLength: 64, composition: false, breachCheck: true },
    pci: { name: 'PCI-DSS v4.0', minLength: 7, composition: true, requireUpper: true, requireLower: true, requireDigit: true, requireSymbol: true },
    hipaa: { name: 'HIPAA', minLength: 8, composition: true, requireUpper: true, requireLower: true, requireDigit: true }
  };

  const results = {};
  for (const [key, policy] of Object.entries(policies)) {
    const violations = [];
    if (password.length < policy.minLength) violations.push(`Minimum length: ${policy.minLength}`);
    if (policy.composition) {
      if (policy.requireUpper && !/[A-Z]/.test(password)) violations.push('Requires uppercase');
      if (policy.requireLower && !/[a-z]/.test(password)) violations.push('Requires lowercase');
      if (policy.requireDigit && !/[0-9]/.test(password)) violations.push('Requires digit');
      if (policy.requireSymbol && !/[^a-zA-Z0-9]/.test(password)) violations.push('Requires symbol');
    }
    results[key] = { name: policy.name, compliant: violations.length === 0, violations };
  }
  return results;
}

console.log(checkPasswordPolicy('Summer2024!'));
// { nist: { compliant: true }, pci: { compliant: true }, hipaa: { compliant: true } }

class PasswordPolicy {
  constructor(options = {}) {
    this.minLength = options.minLength || 8;
    this.maxLength = options.maxLength || 64;
    this.requireUpper = options.requireUpper || false;
    this.requireLower = options.requireLower || false;
    this.requireDigit = options.requireDigit || false;
    this.requireSymbol = options.requireSymbol || false;
    this.bannedPatterns = options.bannedPatterns || [];
  }

  evaluate(password) {
    const results = { violations: [], warnings: [], score: 0 };

    if (password.length < this.minLength) results.violations.push(`Too short: ${password.length}/${this.minLength}`);
    else results.score += 20;

    if (this.requireUpper && !/[A-Z]/.test(password)) results.violations.push('Missing uppercase');
    else if (this.requireUpper) results.score += 15;

    if (this.requireLower && !/[a-z]/.test(password)) results.violations.push('Missing lowercase');
    else if (this.requireLower) results.score += 15;

    if (this.requireDigit && !/[0-9]/.test(password)) results.violations.push('Missing digit');
    else if (this.requireDigit) results.score += 15;

    if (this.requireSymbol && !/[^a-zA-Z0-9]/.test(password)) results.violations.push('Missing symbol');
    else if (this.requireSymbol) results.score += 15;

    for (const pattern of this.bannedPatterns) {
      if (password.toLowerCase().includes(pattern.toLowerCase())) {
        results.violations.push(`Contains banned: ${pattern}`);
        results.score -= 20;
      }
    }

    results.compliant = results.violations.length === 0;
    return results;
  }
}

const policy = new PasswordPolicy({ minLength: 12, requireUpper: true, requireLower: true, requireDigit: true, bannedPatterns: ['password', 'admin'] });
console.log(policy.evaluate('MyStr0ng!Pass'));
// { compliant: true, score: 65 }

Benefits

• Tests passwords against 5 major compliance frameworks: NIST 800-63B, PCI-DSS, HIPAA, SOC 2, and custom policies.
• Reveals the gap between policy compliance and actual security — showing that meeting requirements doesn't guarantee strength.
• Custom policy builder lets organizations define their own rules with granular composition and pattern controls.
• Provides entropy calculations alongside compliance checks for a complete security picture.
• Flags passwords found in breach databases regardless of policy compliance — a password can pass every rule and still be compromised.

Use Cases

Common Mistakes to Avoid

Security Implications

Security Information

All policy evaluation runs client-side. No password data is transmitted. The tool is designed for security auditing and education — it helps organizations identify gaps in their password policies and understand where compliance does not equal security. Policy templates are based on publicly available framework specifications (NIST, PCI-DSS, HIPAA) and are updated as standards evolve.

Best Practices

• Adopt NIST 800-63B guidelines: minimum 8 characters, no composition rules, breach database checking, no mandatory periodic changes.
• If you must enforce composition rules, require minimum 12 characters to ensure adequate entropy despite predictable patterns.
• Implement breach database checking (Have I Been Pwned API) to block known-compromised passwords regardless of policy compliance.
• Audit your policy annually against current research — outdated policies can make passwords weaker, not stronger.
• Communicate to users that meeting policy minimums is the floor, not the ceiling — longer random passwords are always better.