Settings
Demo only: this project has no accounts, so the
settings nav below is filtered against a pretend role instead of a
real one. You are currently viewing this as
an administrator.
Why the default is a length, not a character-class rule:
NCSC's current guidance favours a longer minimum length over forced
complexity, because mandatory character classes mostly train people
to append
!1 to something memorable rather than
producing a genuinely stronger password. This project ships a
12-character minimum with nothing forced by default - the four
toggles below exist only as an explicit "this organisation wants it
against NCSC's advice" escape hatch, never as an equally-valid
alternative.
What this means in practice
At the current minimum length (12 characters), a password made of upper/lowercase letters and digits would take roughly longer than is meaningful to state to brute-force at a billion guesses a second - illustrative only, not a real entropy calculation for any specific password.
A longer, memorable passphrase easily clears this minimum without needing a single forced symbol.