Systems and methods for evaluating a password policy

A method for evaluating a password policy, comprising:

• receiving at an evaluation system, from a user, password policy data regarding a password policy, including a password constraint;
• analyzing, by the evaluation system, said password policy data to determine a usability index and a password strength index for said password policy;
• determining, by the evaluation system, a usability index and a password strength index for a plurality of modified password policies having password constraints different from said password policy;
• creating, by the evaluation system, a curve of the usability index against the password strength index for said password policy and said modified password policies;
• determining, by the evaluation system, one or more inflection points in said curve where a change in the password strength index has an increased effect on the usability index;
• and
• providing a recommended password policy constraint to the user based on the step of determining an inflection point.

A system for evaluating a password policy, comprising:

• at least one computer, said computer configured to perform the following steps:
• receiving password policy data regarding a password policy, including a password constraint;
• analyzing said password policy data to determine a usability index and a password strength index for said password policy;
• determining a usability index and a password strength index for a plurality of modified password policies having password constraints different from said password policy;
• creating a curve of the usability index against the password strength index for said password policy and said modified password policies;
• determining one or more inflection points in said curve where a change in the password strength index has an increased effect on the usability index;
• providing a graphical representation of the usability index and the password strength for said password policy and said modified password policies;
• and
• providing a recommended password policy constraint based on the one or more inflection points.

An article of manufacture comprising a non-transitory computer program carrier readable by a computer and embodying instructions executable by the computer to program a computer to perform the following steps for evaluating a password policy:

• receiving password policy data regarding a password policy, including a password constraint;
• analyzing said password policy data to determine a usability index and a password strength index for said password policy;
• determining a usability index and password strength index for a plurality of modified password policies having password constraints different from said password policy;
• creating a curve of the usability index against the password strength index for said password policy and said modified password policies;
• determining one or more inflection points in said curse where a change in the password strength index has an increased effect on the usability index;
• providing a graphical representation of the usability index and the password strength for said password policy and said modified password policies;
• and
• providing a recommended password policy constraint based on the one or more inflection points.