Group
  • Security

    Set a sane password policy

    Enforces minimum length and breached-password checks without arbitrary complexity rules that push users to weak patterns.

    • Improve quality
    • Plan & validate
    • Beginner
    • General

Free Prompt

Review my app's password policy at signup and password change, and bring it in line with current guidance (NIST SP 800-63B). Implement: a minimum length of at least 8 characters (12 if the app handles money or sensitive data), no arbitrary complexity rules requiring specific character types, no forced periodic expiration, a maximum length of at least 64 characters, and support for spaces and pasted passwords (so password managers work). Check passwords against a known-breached list (the Have I Been Pwned password API or a local blocklist of common passwords) and reject ones that appear in breaches. Show strength feedback to the user without blocking them from using a strong generated password. Do not add uppercase/number/symbol requirements; they push users toward predictable patterns like Password1! and do nothing against modern cracking. Do not truncate passwords. Keep the existing signup UI layout. Show me the policy before and after. Give me a test matrix: passwords that should be accepted (a long passphrase, a generated random string) and rejected (short, on the common-password list) so I can verify the behavior.

What This Does / How This Helps

Replaces the usual checkbox complexity rules with a policy that actually matches current NIST guidance: length and breached-password screening instead of symbol requirements. Complexity rules feel like security but mostly train users to append 1! to their usual password. Meanwhile the two things that genuinely matter, length and not using a password from a breach list, often go unchecked. Password managers also break on sites that block pasting or cap length at 16 characters. You get the policy updated with a test matrix showing exactly which passwords should pass and fail, so verification takes two minutes.

Want to skip doing this by hand?

Fortivibe audits your app for all of the areas these prompts cover (and more).

See What We Check

Related Prompts