Password Policy Lab
Most password policies are a pile of habits nobody has re-checked against the guidance. Work a queue of proposed rules and build a standard that actually follows NIST SP 800-63B: keep what strengthens secrets — a length minimum, breach-list screening, throttling, password managers, strong hashing — and kill the legacy theatre — 90-day rotation, forced composition rules, security questions, SMS-only reset, paste blocks. Watch the traps: a compromise-triggered reset is not scheduled rotation, and a 15-character admin minimum is length, not complexity. Kill the bad rules without stripping the good ones.
The real job. More noise, a tighter clock.
Policy review
For each proposed rule, decide KEEP (aligns with NIST SP 800-63B) or KILL (legacy / counter-productive), then name the principle.
Proposed rule #1
Passwords expire every 90 days; users are forced to choose a new one.
context: Carried over from the old domain policy "to limit exposure window."
Proposed rule #2
Minimum length is 8 characters; passphrases up to at least 64 characters are allowed.
context: Proposed by the identity team rewriting the standard around length.
Proposed rule #3
Every password must contain uppercase, lowercase, a digit, and a special character.
context: The classic "complexity" rule from the hardening guide.
Proposed rule #4
Check each new or changed password against a known-breached-password list and reject any match.
context: Wire the chosen secret through a compromised-credential corpus at set time.
Proposed rule #5
Account recovery relies on security questions (first pet, mother’s maiden name, first car).
context: Self-service reset flow asks the pre-set questions to verify identity.
Proposed rule #6
Throttle and temporarily lock an account after repeated failed sign-in attempts.
context: Rate-limit the authentication endpoint against online guessing.
Proposed rule #7
Disable paste in the password field to stop copy/paste mistakes and shoulder-surfing.
context: A vendor control toggle that blocks paste on the login form.
Proposed rule #8
Offer a password-strength meter and a show/reveal control while the user types.
context: Usability guidance surfaced at the point of password creation.
Proposed rule #9
Block browser and third-party password managers; require users to type passwords manually.
context: An endpoint-hardening item framed as reducing stored-credential risk.
Proposed rule #10
Send the only account-recovery / reset code via SMS text message.
context: Single-channel reset: a one-time code texted to the number on file.
Build the standard
Call each rule, then grade. So far 0/10 decided, 0/6 bad rules killed, 0 good control(s) stripped.
How it is scored
The KEEP / KILL call is the core decision; naming the right NIST principle is a correctness bonus.
Killing a sound control takes an extra hygiene bite — a standard that strips good rules is as broken as one that keeps bad ones.
Harder tiers add subtler rules and deliberate traps (a compromise-triggered reset, a 15-char admin minimum, Unicode acceptance).
Live arena
4 activeadversary staging…
What this lab is
- A free, browser-based password-policy lab: review a queue of proposed rules and build a standard that follows NIST SP 800-63B — keep each good rule, kill each legacy one.
- Keep what NIST wants: an 8-character minimum (15+ for privileged) allowing passphrases up to 64, breached-password screening, rate-limiting of failed attempts, paste and password managers, strong salted hashing, Unicode acceptance, and a compromise-triggered reset.
- Kill the legacy habits NIST tells you to drop: forced periodic (90-day) rotation, mandatory composition / complexity rules, password hints and security questions, SMS-only recovery, and paste/manager blocks.
- You are scored on killing every bad rule without stripping a sound control — removing a working NIST control takes an extra hygiene penalty, and you also name the principle behind each call.
- Harder tiers add deliberate traps: a 15-character admin minimum (keep), a compromise-triggered reset that only looks like scheduled rotation (keep), and Unicode/emoji acceptance (keep).
Frequently asked questions
What is the Password Policy Lab?
A free, in-browser exercise where you review proposed password-policy rules one at a time and decide whether each belongs in a modern standard — KEEP it (it aligns with NIST SP 800-63B) or KILL it (it is a legacy, counter-productive practice) — and then name the NIST principle that governs the call. It turns the abstract guidance into concrete keep/kill decisions on the exact rules organisations still argue about.
Is the guidance real NIST 800-63B?
Yes. Every rule maps to actual NIST SP 800-63B / 800-63B-4 "Memorized Secret" guidance: an 8-character minimum with support for at least 64, screening against known-compromised passwords, no forced periodic rotation (rotate only on evidence of compromise), no mandated composition rules, no password hints or knowledge-based authentication, SMS as a restricted out-of-band channel, allowing paste and password managers, rate-limiting failed attempts, accepting all printable and Unicode characters, and salted strong one-way hashing.
How is it graded?
The keep/kill decision is the core call; naming the right governing principle is a correctness bonus. Killing a sound control (a false kill) carries an extra hygiene penalty, because a standard that strips good rules is as broken as one that keeps bad ones. A perfect run kills every legacy rule, keeps every good control, and names the right NIST principle for each.
Who is it for?
Security leaders writing or defending a password standard, IAM and platform engineers implementing it, GRC and audit staff reconciling a legacy baseline against modern guidance, and anyone preparing for a security interview who wants to internalise why 90-day rotation and composition rules are out and length plus breach screening are in. It runs entirely in your browser — no account, no install, nothing sent anywhere.