Lesson 3.5: Password policy and breached passwords
What a good password policy looks like today, based on NIST SP 800-63B and similar guidance worldwide: length over complexity, blocking passwords known from breaches and common patterns, no forced periodic changes, password managers, and multi-factor authentication on top. Why 'Summer2026!' passes old complexity rules and fails in reality. In the lab you test candidate passwords against a blocklist with grep, check length with awk, look at the password-ageing settings, and see how a breached-password service can be queried without revealing the password.
17 min
You will learn to
- Explain modern password guidance (length, blocklists, no forced rotation)
- Check candidates against a blocklist
- Check minimum length
- Explain k-anonymity for breached-password checks
- Explain why MFA and password managers matter
Key terms
- NIST SP 800-63B
- The US National Institute of Standards and Technology's guideline on authentication, widely followed internationally.
- Passphrase
- A long password made of several words.
- Blocklist
- A list of passwords that are refused because they're known from breaches or too predictable.
- k-anonymity
- Hiding a value among many others: you query with a short prefix shared by many hashes, so the service can't tell which one is yours.
- Password manager
- Software that generates and stores a unique random password for every site, protected by one master password.
- MFA and passkeys
- A second proof besides the password (app code, security key); passkeys replace the password with a key pair on the device.
← Protecting sessions and cookies · All lessons · The Cyber Kill Chain: an attack step by step →