Validate Password Policy — Check NIST & OWASP Compliance

Configure a Robust Password Validator — Policy Settings and Programmatic Rules

Beyond the built-in presets, a truly robust password validator lets you tune length, character types, pattern restrictions, and advanced options to match your own requirements. The password pattern analyzer identifies the specific patterns attackers prioritise — dictionary words, sequences, and substitutions.

Password Length Requirements — Minimum and Maximum Length Thresholds

Password length is the single most impactful variable in password complexity. The tool lets you set a minimum password length and a maximum password length independently. PCI DSS version 4.0 requirements mandate a minimum of 12 characters; NIST SP 800-63B sets a minimum 8 characters floor while encouraging longer passphrases; HIPAA security requirements recommend 12 characters or more for healthcare data security contexts.

Required Character Types — Uppercase, Lowercase, Digits, and Symbols

The character set validator enforces specific character types within each password: lowercase characters required (a–z), uppercase characters required (A–Z), numbers required (0–9), and symbols required (!#$%). For short passwords, the minimum character types rule typically demands all four types. For longer passphrases, length can supply sufficient password entropy with only two types required — a concept formalised by the Gibson Research Corporation password haystacks concept.

In a .NET development context using the FluentValidation library, these checks are expressed through the AbstractValidator<string> pattern. Each rule uses a RuleFor call with a .Must() predicate and a .WithMessage() clause. The requirement for at least one uppercase character, for example:

// At least one uppercase character
RuleFor(password => password)
    .Must(password => password.Any(char.IsUpper))
    .WithMessage("Password must contain at least one uppercase character");

Pattern Restrictions — Blocking Sequential and Repeated Characters

Pattern restrictions prevent passwords from relying on predictable structures that make dictionary attacks and brute force attacks trivially easy:

• No sequential characters — blocks alphabetical sequences (abc, xyz) and consecutive digits (123, 456).
• No repeated characters — blocks substrings where the same character repeats more than a specified number of times (e.g., "aaaa" or "1111"), case-sensitive or case-insensitive.
• No keyboard patterns — scans for sequential keyboard characters drawn from known keyboard row sequences (e.g., "qwerty", "asdfg", "12345").
• No dictionary words — checks the proposed password against a specified dictionary file, optionally testing the password in reverse order.
• No common passwords — blocks the 10,000 most-used passwords attackers frequently try first.

Advanced Policy Options — Breach Databases, Entropy, and Similarity Rules

Beyond character rules and pattern restrictions, a truly robust password validator addresses password reuse prevention and compromised credentials:

• Check against breach databases — connects to a Pwned Passwords–style service using k-anonymity hashing so the password never leaves your device in full.
• Minimum entropy bits — sets a numeric floor for password entropy; NIST recommends at least 30 bits as a minimum baseline.
• Similarity-based checker — ensures a new password isn't too similar to the current one using the Levenshtein distance algorithm.
• Unique characters validator — requires a minimum number of unique characters, optionally case-insensitive.
• Regular expression validator — lets you define a custom regex a password must or must not match.

Policy Configuration Reference Table

Programmatic Policy Configuration Examples

The AbstractValidator class from the FluentValidation library provides a clean, fluent interface for expressing password policy constants in C#. This pattern enforces a comprehensive set of rules including the no-sensitive-data rule, no phone-number-sequence rule, and the core password-cannot-be-empty constraint — complementing any server-side checks:

public class PasswordValidator : AbstractValidator<string>
{
    private readonly string _phoneNumber;
    private readonly string? _idNumber;
    private readonly DateTime? _dob;

    public PasswordValidator(string phoneNumber, string? idNumber, DateTime? dob)
    {
        _phoneNumber = phoneNumber ?? string.Empty;
        _idNumber = idNumber;
        _dob = dob;

        RuleFor(password => password)
            .NotEmpty()
            .WithMessage("Password cannot be empty");

        RuleFor(password => password)
            .Must(ValidateLength)
            .WithMessage(
                $"Password must be at least {PasswordPolicyConstants.MinimumPasswordLength} characters long");

        RuleFor(password => password)
            .Must(password => password.Any(char.IsUpper))
            .WithMessage("Password must contain at least one uppercase character");

        RuleFor(password => password)
            .Must(password => !ContainsIdenticalCharacters(
                password, PasswordPolicyConstants.MaxConsecutiveIdenticalCharacters))
            .WithMessage("Password cannot contain consecutive identical characters");

        RuleFor(password => password)
            .Must(password => !ContainsAlphabeticalSequence(
                password, PasswordPolicyConstants.MaxAlphabeticalSequenceLength))
            .WithMessage("Password cannot contain alphabetical sequences");
    }
}

For PingDirectory enterprise environments, the backend SDK enables you to create and save your own password policies with the constraints necessary for your environment, going beyond the built-in types. For Apple platforms, the descriptor for UITextInputPasswordRules generates a string you pass to the iOS UI framework's password rules input attribute, enabling password autofill to generate passwords that comply with your policy. The equivalent HTML output provides the attributes for <input type="password">, supporting web verification and form validation on any platform.

Who This Tool Is Built For — Custom Password Validators Across Every Team

From security audits to everyday policy checks, the validator adapts to how different teams work.

Security Professionals

Quickly probe whether any credential — yours, a test account's, or a sample from a system export — satisfies every rule in a given policy framework. Select a preset policy (NIST, PCI DSS, HIPAA) or build custom rules to mirror exactly what your target environment enforces, then run candidates through the validator to surface non-adherence.

Audit Teams

Preparing for a PCI DSS, HIPAA, or NIST assessment, the tool's pre-configured compliance policies let you validate passwords against regulatory requirements systematically — running through a representative sample of credentials to identify gaps before an auditor does.

IT Administrators

Calibrate policy configuration so rules are strict enough to satisfy IT security and enterprise requirements but practical enough that users aren't constantly locked out. Test the impact of tightening the minimum length or enabling keyboard-pattern restrictions before rolling a change out to production.

Bulk Password Testing

Validate up to 50 passwords simultaneously, making it practical to run a batch audit of exported credential lists or generated passwords. Each entry is verified against the active policy and tagged with pass/fail per rule and overall status, so you can filter to show only failures for fast remediation.