About This Tool

Primary Use Case

Key Features

• Comprehensive list of websites with dumb password rules
• Includes screenshots and descriptions of offending password rules
• Community-driven contributions via pull requests or direct messaging
• Public website showcasing collected rules at dumbpasswordrules.com
• Automated bot that periodically posts random dumb password rules
• Active contributor community with clear guidelines for additions and improvements

Insights & Recommendations

This repository functions primarily as a dataset and awareness tool rather than a software package, so it does not include installation steps or command-line usage. Contributors should follow the contributing guidelines for submitting new entries or improvements. The dataset is useful for educational and research purposes to highlight poor password security practices.

Smart Usage Notes

• Use the dataset to simulate weak password policies during red team engagements to identify exploitable authentication weaknesses.
• Incorporate examples from the dataset into security awareness training to educate developers and users on poor password practices.
• Leverage the dataset for purple team exercises to collaboratively improve password policy enforcement and detection capabilities.
• Integrate the dataset into automated security testing tools to flag weak password rules during application development.
• Use the community-driven nature of the dataset to keep password policy assessments up to date with emerging poor practices.

Security Capability Profile