Password Length Policy
Character & Composition Rules
Phone number required at registration
Multi-Factor Authentication
Forced phone-only 2FA — no authenticator app, no backup codes
Anti-Pattern Penalties
Password Manager Compatibility
Breach Response & Credential Hygiene
Overly restrictive character rules
Accept all printable ASCII and Unicode characters. Remove composition requirements (no "must contain uppercase + number")
Reference: NIST SP 800-63B §5.1.1
Weak or missing MFA support
Implement TOTP (authenticator apps) and FIDO2/WebAuthn hardware keys. Work toward passkeys as a passwordless option
Reference: NIST SP 800-63B §4.3.1
No breach detection
Check new passwords against known-breached lists (e.g. HaveIBeenPwned API). Notify users of relevant breaches
Reference: NIST SP 800-63B §5.1.1.2
Help the community by testing this policy yourself. Earn +5 karma for each verification.