# Password Policy Tester

> Test a password against a policy and see whether the policy actually improves security.

A password policy tester checks a password against length and composition rules. It also reports the theoretical entropy and an estimated crack time — and explains that NIST dropped composition rules in 2017, because requiring a symbol and a digit produces predictable passwords like Password1! rather than strong ones.

**URL:** https://convertto.tech/t/password-policy-tester
**Category:** Hash & Crypto Tools (https://convertto.tech/c/crypto-tools)
**Privacy:** Runs entirely in the browser; no upload
**Cost:** Free, no sign-up
**Last updated:** 2026-08-01

## Key facts

- **Runs locally:** The password is never transmitted, logged or stored
- **Current guidance:** NIST SP 800-63B recommends length and breach screening over composition rules
- **Privacy:** Runs entirely in your browser — nothing is uploaded
- **Cost:** Free, unlimited, no sign-up

## How to use

1. Enter the password — it stays in your browser and is never sent anywhere.
2. Set the minimum length.
3. Set the maximum repeated character run.
4. Turn "Reject common passwords" on or off as needed.
5. Turn "Require an uppercase letter" on or off as needed.
6. Turn "Require a lowercase letter" on or off as needed.
7. Turn "Require a digit" on or off as needed.
8. Turn "Require a symbol" on or off as needed.
9. The result appears immediately — copy or download it.

## FAQ

### Why does Password1! pass every rule but score badly?

Because composition rules test the shape of a password, not its unpredictability. Capitalising the first letter, appending a digit and ending with an exclamation mark is the most common pattern there is, so a cracking dictionary tries it in the first few thousand guesses.

## Related tools

- [Password Strength Checker](https://convertto.tech/t/password-strength-checker): Estimate how long a password would take to crack, and see exactly what weakens it.
- [Bcrypt Hash Generator](https://convertto.tech/t/bcrypt-hash-generator): Hash a password with bcrypt at a configurable cost factor — the right way to store passwords.
- [Passphrase Generator](https://convertto.tech/t/passphrase-generator): Generate memorable Diceware-style passphrases from random words.
- [Password Generator](https://convertto.tech/t/password-generator): Generate strong random passwords using your browser's cryptographic random source.
- [Protect PDF with Password](https://convertto.tech/t/protect-pdf): Encrypt a PDF with a password using AES-128, and choose what readers are allowed to do.
- [SSH Key Fingerprint Calculator](https://convertto.tech/t/ssh-key-fingerprint): Compute the SHA-256 and MD5 fingerprints of an OpenSSH public key and read its details.
- [TOTP Code Generator](https://convertto.tech/t/totp-generator): Generate time-based one-time passwords from a Base32 secret to test 2FA setups.
- [Content Security Policy Generator](https://convertto.tech/t/csp-generator): Build a CSP header from common presets, with each directive explained.