Password Policy Batch Auditor
Tests a list of passwords against the policy you define, showing which fail, which rules they break and the equivalent regex.
Nothing leaves your browser. The audit runs in this page with JavaScript only: no upload, no request, no storage. The report shows a mask (first two characters, length, last two) and never the full password. Even so, prefer test values or passwords that are already being rotated.
Policy
Matched anywhere inside the password, ignoring case and accents.
Summary
Tested
0
Passed
0
Pass rate
0%
Most broken rules
Per password
| # | Password (masked) | Result | Broken rules |
|---|
Equivalent regex
The regex covers length and the four required-class checkboxes only. Denylist, sequences, repeats and the "min. classes" counter stay out of it — expressing them as lookaheads would be unreadable and easy to get wrong, so keep those four checks in code next to the regex.
How each rule is applied
Character classes are ASCII, the same ones the generated regex uses: [a-z], [A-Z], [0-9] and everything else as symbol. A space counts as a symbol and an accented letter falls under symbol too, so the audit and the regex never disagree about the same password. Length is counted in UTF-16 units, matching what .{min,max} does.
A sequence is any run of three characters that walks the alphabet or the digits one step at a time, up or down, plus any three keys side by side on a QWERTY row — qwe and ewq both trip it. The repeat rule looks for the same character three times in a row. NIST 800-63B asks for a length floor and a denylist of known-bad values; composition rules beyond that are optional, so leave the boxes you do not enforce unchecked instead of auditing against a stricter policy than the real one.
Test a list of passwords against your company policy
A password policy usually lives in a document and, somewhere else, in a form field that accepts far more than the document says. This auditor brings the two together: tick what you enforce, paste the test passwords one per line and read the verdict for each one, with the broken rules spelled out. A summary closes the report with the pass count and the rules that knocked out the most passwords.
Character classes match the generated regex: lowercase, uppercase, digit and everything else as a symbol. A sequence is any run of three characters walking the alphabet or the digits one step at a time, in either direction, plus three keys side by side on a QWERTY row. The repeat rule looks for the same character three times over. The denylist compares without case or accents, so Acme catches acme.
The regex comes out ready to paste into backend validation, with one lookahead per required class and the length quantifier at the end. It covers those two things and no more: denylist, sequences, repeats and the minimum-class counter stay outside, since they would turn into unreadable expressions. Keep those four checks in code, right next to the regex, so nobody has to guess where they live.
Frequently asked questions
Do the pasted passwords leave the browser?
Why is the password truncated in the table?
Is the generated regex enough as validation?
Related Tools
Bcrypt Hash Generator
Generate secure bcrypt hashes from passwords and verify whether a password matches an existing bcrypt hash.
Password Strength Checker
Analyze the strength of any password: length, character classes, entropy in bits and resistance estimate. Processed in the browser — the password never leaves your device.
Common Password Blacklist Check
Checks a password against the top 1000 most-used passwords, fully client-side, and flags it as compromised.