Weak Password Policy
Applications that allow weak, short, or common passwords are vulnerable to brute-force and dictionary attacks. Lack of password complexity requirements, length minimums, or breach-checking significantly reduces account security.
Overview
Weak password policies allow users to create easily guessable or commonly used passwords, dramatically increasing the risk of account compromise. Modern password guidance from NIST (SP 800-63B) recommends focusing on password length over complexity, checking against breach databases, and avoiding arbitrary complexity rules that lead to predictable patterns.
Impact
Easy account compromise, brute-force success, credential theft.
Remediation
Enforce minimum password length (12+ characters), check against common password lists and breach databases, encourage passphrases, and implement MFA.
Require minimum 12-character passwords
Check passwords against known breach databases
Block the top 100,000 most common passwords
Allow and encourage long passphrases
Do not require periodic password rotation without cause
Implement MFA as a complementary control
Related SuperClue scanner checks
These scanner checks look for signs of Weak Password Policy. What a scan can confirm from outside depends on your application.
Scan a domain you have verified with up to 350 modules, paid in credits.
See how website scanning works