Password Policy Checker
How it works
Only the rules you enable above are checked — a blank "min length" field, or an unchecked box, simply removes that rule from the policy rather than counting as a pass or a fail. "Meets policy" means every enabled rule passed; if even one fails, the password does not meet the policy as configured, regardless of how many others it satisfies.
Frequently asked questions
How does this differ from the Password Strength Checker?
The Password Strength Checker estimates entropy and guessability as a single score. This tool instead checks a password against explicit, configurable rules you set — the kind of policy a signup form might enforce (minimum length, character classes required) — so you can confirm a password meets specific stated requirements rather than a general strength estimate.
Why aren't disabled rules silently checked anyway?
A rule you didn't enable isn't part of your policy. Checking it anyway would be enforcing a requirement nobody asked for — the checklist only ever reports on the rules you turned on.
Is the common-password list here exhaustive?
No — it is small and illustrative, meant to catch the most obviously bad choices. A real production system should check against a much larger, regularly updated database of breached passwords. This is a lightweight, local check only, consistent with this site making no network requests at all.