Weak Password Policy Detection
The site accepts weak passwords, so users can choose ones that bots crack in seconds or find in every breach list.
What is Weak Password Policy Detection?
A password policy decides how hard your users' credentials are to guess. Policies that allow short passwords (under 8), common passwords (password123, qwerty...), or breached passwords hand attackers a predictable target: credential-stuffing tools test the top few thousand passwords against every login form on the internet. Modern guidance (NIST SP 800-63B) has flipped from the old complexity rules: length beats composition, forced periodic rotation hurts (users make predictable tweaks), and the single most effective check is screening new passwords against known-breached lists. If your signup form accepts "Summer2026!", your policy is decoration.
Why It Matters to Your Business
Weak passwords are the cheapest way into an account: no vulnerability needed, just a wordlist. One weak admin password means total compromise; weak user passwords mean bulk account takeover during any stuffing campaign. The cost of a strong policy is a few lines of validation — the cost of the accounts it would have protected is support volume, fraud, and reputation. Auditors specifically check whether signup and password-change flows reject known-breached passwords.
How to Fix It
1. Enforce minimum length 10+ (12 for admin accounts) and maximum length 64+ (allow passphrases and password managers).
2. Block the obvious: top/common password lists, and dictionary words equal to the service or company name.
3. Screen against breached passwords (k-anonymity API — no password is sent in clear):
// Pwned Passwords range API
$prefix = substr(sha1($password), 0, 5);
$suffix = substr(sha1($password), 5);
$list = file_get_contents('https://api.pwnedpasswords.com/range/'.$prefix);
$breached = str_contains($list, strtoupper($suffix));
Laravel ships this out of the box: 'password' => ['required', Password::min(10)->uncompromised()]
4. Do NOT force periodic rotation (NIST 800-63B) — rotate on evidence of compromise instead.
5. Drop the composition rules (symbols! digits!) — they produce Password1! patterns. Length + breach check is stronger.
6. Offer MFA on every account tier; for admins, require it.
Frequently Asked Questions
What makes a password policy strong in 2026?
Minimum length 10-12, no maximum below 64, screening against known-breached passwords, and a short common-password blocklist. NIST 800-63B explicitly recommends dropping forced rotation and symbol-composition rules — length and breach screening are what actually matter.
Are the classic complexity rules (symbol, digit, capital) bad?
Mostly theater: users respond with Password1! patterns that satisfy the rule and crack instantly. Length requirements plus breached-password screening are measurably stronger and easier on users.
Does a strong password policy matter if we have MFA?
Yes — MFA reduces the value of a stolen password but does not make it worthless (session theft, MFA fatigue, bypass techniques exist). Strong passwords plus MFA are layered controls, not alternatives.
Technical Classification
| OWASP Category | A07:2021 — Identification and Authentication Failures |
| CWE ID | CWE-521: Weak Password Requirements |
| Detected By | password_policy, login_form scanner(s) |
| Severity Level | medium |
How 2MNY Security Can Help
Check if your website has this vulnerability
Our password_policy, login_form scanner checks for this issue automatically.
Scan My Website FreeRelated Vulnerabilities
Open Redirect Vulnerability
The site has an open redirect — a parameter that redirects to any URL, allowing phishing campaigns that appear to come from your domain.
Dangerous HTTP Methods Enabled
The server allows dangerous HTTP methods (PUT, DELETE, TRACE, CONNECT, WebDAV) that can be abused for file upload, deletion, or cross-site tracing.
SQL Injection (Reflected) Vulnerability
Unvalidated user input flows into database queries, letting attackers read your data or take over the server.
Reflected Cross-Site Scripting (XSS)
User input is echoed into pages unescaped, so crafted links run attacker JavaScript in your visitors' browsers.