What this tool does
Paste password policy statements as free text — from a wiki page, an RFP response, a security questionnaire, or just a couple of bullet points — and this recognizes common rules (minimum length, rotation, composition requirements, MFA, breach-checking, and more) and checks each one against NIST SP 800-63B, the current authoritative standard for memorized-secret policy.
This runs the opposite direction from Password Policy Generator: that tool starts from structured settings you choose and produces a policy document. This one starts from unstructured text — the kind you actually encounter when reviewing someone else's policy — and extracts what it can recognize.
How recognition works, and its real limits
Detection is pattern matching over common phrasings, not a language model — it recognizes "minimum length 8" and "passwords must be at least 8 characters long" as the same rule, but unusual wording can slip past it entirely. Anything not recognized is listed under Not recognized rather than silently dropped, so it's clear what the tool actually processed versus what it skipped.
The Not addressed by this text section works differently — it flags NIST requirements (breach-checking specifically) and widely recommended controls (MFA) that this excerpt never mentions at all. That's a real gap in what you pasted, not necessarily a gap in the actual policy — a short excerpt might simply not include every rule the real policy has.
Why the verdict can flag things that sound reasonable
Mandatory rotation and required character composition are the two most common surprises — both sound like obviously good security practice, and both are specifically recommended against by current NIST guidance. Forced rotation on a fixed schedule tends to produce predictable, related passwords rather than stronger ones, and mandatory composition rules push toward predictable patterns (a capital first letter, a symbol at the end) without meaningfully increasing real entropy. Neither recommendation is new or obscure — 800-63B has said this since its 2017 revision — but plenty of real policies still haven't caught up.
Try it yourself
Password Policy Generator is the tool to reach for once you know what a policy should say — pick settings and get a ready-to-adopt document plus the same NIST alignment check, generated instead of parsed.
FAQ
Is my pasted policy text sent anywhere?
No — parsing and analysis both run entirely in your browser.
Why didn't this recognize a rule I know is in the text?
The detector list covers common phrasings for the rules people paste most — length, rotation, composition, history, MFA, breach/common-password checking, lockout, and paste behavior. A rule phrased unusually, or one outside that list entirely (like password expiration warnings or account-sharing policy), won't be recognized. Check the Not recognized section to see exactly what was skipped.
The tool says my policy is missing MFA, but I know MFA is required elsewhere in our docs — is that wrong?
Not wrong, just scoped to what you pasted — the Not addressed by this text section is explicit that it's reporting what this specific excerpt doesn't establish, not a claim about your organization's actual, complete policy.