Password Policy Analyzer

Lab: Build a Password Policy Analyzer (Python + Kali Linux)

Built a Python-based password policy auditing platform that evaluated organizational credential requirements against modern password guidance, automated policy scoring, generated compliance reports, and identified gaps in credential hygiene.

This tool will:

• Evaluate password strength
• Compare an organization’s password policy against standards
• Generate findings + remediation guidance
• Produce a security report

---

Step 1 — Create Project Folder

Open Terminal

Run:

mkdir password-policy-analyzer

cd password-policy-analyzer

To verify, run:

pwd

SUMMARY:

Open Terminal, Folder created, Current directory shown

---

Step 2 — Create Python Virtual Environment

Install venv:

sudo apt update

sudo apt install python3-venv -y

Create environment:

python3 -m venv venv

Activate:

source venv/bin/activate

---

Step 3 — Install Dependencies

Install packages:

pip install pandas tabulate zxcvbn

Verify, run:

pip list

The List of Expected packages: pandas tabulate zxcvbn

---

Step 4 — Create Project Files

Run:

touch analyzer.py

touch password_policy.json

touch report.txt

Open VS Code:

code .

SUMMARY:

The Folder should look like:

password-policy-analyzer │ ├── analyzer.py ├── password_policy.json ├── report.txt └── venv

---

Step 5 — Create Example Password Policy

Open:

password_policy.json

Type:

{ "minimum_length": 8, "require_uppercase": true, "require_numbers": true, "require_symbols": true, "expiration_days": 90, "allow_common_passwords": false }

Save

---

Step 6 — Create the Analyzer

Open: analyzer.py Type:

import json
from zxcvbn import zxcvbn
from tabulate import tabulate


with open("password_policy.json") as f:
   policy = json.load(f)


audit=[]


if policy["minimum_length"] < 12:
   audit.append(
       ["Minimum Length",
        "FAIL",
        "Use 12+ characters"]
   )
else:
   audit.append(
       ["Minimum Length",
        "PASS",
        "Good"]
   )


if policy["expiration_days"] <= 90:
   audit.append(
       [
           "Rotation",
           "WARN",
           "Avoid forced resets"
       ]
   )


sample="Summer2026!"


score=zxcvbn(sample)


audit.append([
   "Password Strength",
   score["score"],
   score["feedback"]["warning"]
])


print(tabulate(
   audit,
   headers=[
       "Category",
       "Status",
       "Recommendation"
   ]
))

Save.

---

Step 7 — Run the Analyzer

Terminal:

python analyzer.py

---

Step 8 — Add Industry Benchmark Logic

Update policy rules.

Replace audit section with:

score=0

if policy["minimum_length"] >= 12:
   score += 25

if not policy["allow_common_passwords"]:
   score += 25

if policy["expiration_days"] > 365:
   score += 25

if not policy["require_symbols"]:
   score += 25

print(f"\nPolicy Score: {score}/100")

Run again:

python analyzer.py

---

Step 9 — Export Audit Report

Add:

with open(
   "report.txt",
   "w"
) as r:

   r.write(
       f"Score: {score}/100"
   )

Run:

python analyzer.py

Open:

cat report.txt

---

Step 10 — Just For Fun!

A. Breached Password Detection Install: pip install requests Check passwords against public breach datasets.

---