Password Length Policy
8–20 char range
Character & Composition Rules
Username requires a number (pointless composition rule)
Multi-Factor Authentication
Supports 2FA
Anti-Pattern Penalties
Password Manager Compatibility
Breach Response & Credential Hygiene
Password length restrictions are too tight
Allow minimum 8 chars, support up to at least 64 characters (preferably unlimited)
Reference: NIST SP 800-63B §5.1.1
Overly restrictive character rules
Accept all printable ASCII and Unicode characters. Remove composition requirements (no "must contain uppercase + number")
Reference: NIST SP 800-63B §5.1.1
No breach detection
Check new passwords against known-breached lists (e.g. HaveIBeenPwned API). Notify users of relevant breaches
Reference: NIST SP 800-63B §5.1.1.2
Help the community by testing this policy yourself. Earn +5 karma for each verification.