Skip to content
ZK
ZAIN KHALIL KHAN
PORTFOLIO
All projects

Interactive build

Password Policy Simulator | Attacker Economics

Policy simulator that evaluates password rules against real cracking economics, modelling how composition requirements and forced rotation reduce effective entropy, how hash choice moves guess rate by orders of magnitude, and what share of an organisation falls in a 24-hour offline attack.

Live demo readyPassword Security + NIST 800-63B
Password SecurityNIST 800-63BHashingargon2Attacker EconomicsSecurity PolicyCase study / interactive demo

Case study

From problem to working system

Problem

Policy simulator that evaluates password rules against real cracking economics, modelling how composition requirements and forced rotation reduce effective entropy, how hash choice moves guess rate by orders of magnitude, and what share of an organisation falls in a 24-hour offline attack.

My role

Security engineer and full-stack developer

Solution

Policy simulator that evaluates password rules against real cracking economics, modelling how composition requirements and forced rotation reduce effective entropy, how hash choice moves guess rate by orders of magnitude, and what share of an organisation falls in a 24-hour offline attack.

Architecture

The implementation combines the following technologies and system concerns.

Password SecurityNIST 800-63BHashingargon2Attacker EconomicsSecurity Policy

How it was built

  • Modelled effective entropy rather than theoretical keyspace, since composition rules push users toward the same handful of predictable patterns.
  • Modelled GPU scaling so the effect of a well-resourced attacker is explicit rather than hand-waved.

Security decisions

  • Quantified the cost of forced rotation, which drives incrementing suffixes an attacker guesses from one old password.
  • Modelled GPU scaling so the effect of a well-resourced attacker is explicit rather than hand-waved.
  • Reported organisation-level exposure, the share of accounts recovered in a 24-hour offline attack, which is the number leadership can act on.

Major challenges

  • Quantified the cost of forced rotation, which drives incrementing suffixes an attacker guesses from one old password.
  • Compared MD5, SHA-256, bcrypt, and argon2id guess rates, where the hash choice moves the result by seven orders of magnitude.
  • Reported organisation-level exposure, the share of accounts recovered in a 24-hour offline attack, which is the number leadership can act on.

Verified evidence

Results and measurable impact

  • Modelled effective entropy rather than theoretical keyspace, since composition rules push users toward the same handful of predictable patterns.

Screenshots and access

Product view

Open live project

Interactive Demo

A scoped, fully functional recreation of this project's core feature runs below, live in your browser. Reset it, resize it, or expand it to full screen.

Password Policy Simulator

Security platform

Password Policy SimulatorWorkspace3 updates
Password Policy · Attacker Economicsinstant to crack the median password
357/850 at risk

A password policy should be evaluated against attacker economics, not against how strict it feels. Composition rules push users into predictable patterns, forced rotation makes it worse, and the hash choice moves the result by seven orders of magnitude. The number that matters is what share of the organisation falls in a 24-hour offline attack.

8 characters, three character classes, 90-day rotation. Produces Summer2026! at scale. Unsuitable for passwords. Included because it is still deployed.

Effective entropy

20 bits

after human patterns

Guess rate

65.00e9/s

MD5 × 1

Median crack time

instant

offline, half the keyspace

Org exposure

357/850

recovered in 24h

Org exposure850 accounts
42%cracked 24h
Effective versus theoretical entropy8 chars · 3 classes
Theoretical, if users picked randomly26 bits
Effective, after human patterns20 bits

The gap between those two bars is the whole argument: composition rules and forced rotation shrink the real keyspace while making the policy look stricter.

Policy analysis
Composition rules3 classes · min 8

Three classes at eight characters produces Capital + word + digits + punctuation, which is exactly what a rule-based wordlist generates first. Effective entropy is well below theoretical.

Forced rotationevery 90 days

Rotation without evidence of compromise drives incrementing suffixes, which an attacker with one old password guesses in a handful of tries.

Breached-password screeningabsent

Without screening, a password can satisfy every rule and still be the first entry in a wordlist.

Zain Khalil Khan