Password Policy Analyzer

Paste a password policy and see it measured against current evidence rather than tradition — which means two rules most policies still contain are reported as findings rather than credited. Scheduled rotation with no evidence of compromise produces incremental passwords, so one leak reveals the pattern for all the others; character-class rules narrow the search space rather than widening it, because people satisfy them in the same few ways. The inference it exists for is harder to see: a maximum length of 16 or 20 has no technical justification, because a hash is fixed-length whatever the input, so a cap that low is evidence the password is going into a sized database column and may not be hashed at all. Storage outranks every rule about the password itself, and a policy that states none of the decisive settings is reported as unjudged rather than approved.