V6.2.1: Verify that user set passwords are at least 8 characters in length although a minimum of 15 characters is strongly recommended.
ASVS Maturity
V6.2.2
V6.2.2: Verify that users can change their password.
ASVS Maturity
V6.2.3
V6.2.3: Verify that password change functionality requires the user's current and new password.
ASVS Maturity
V6.2.4
V6.2.4: Verify that passwords submitted during account registration or password change are checked against an available set of, at least, the top 3000 passwords which match the application's password policy, e.g. minimum length.
ASVS Maturity
V6.2.5
V6.2.5: Verify that passwords of any composition can be used, without rules limiting the type of characters permitted. There must be no requirement for a minimum number of upper or lower case characters, numbers, or special characters.
ASVS Maturity
V6.2.6
V6.2.6: Verify that password input fields use type=password to mask the entry. Applications may allow the user to temporarily view the entire masked password, or the last typed character of the password.
ASVS Maturity
V6.2.7
V6.2.7: Verify that "paste" functionality, browser password helpers, and external password managers are permitted.
ASVS Maturity
V6.2.8
V6.2.8: Verify that the application verifies the user's password exactly as received from the user, without any modifications such as truncation or case transformation.
ASVS Maturity
V6.2.9
V6.2.9: Verify that passwords of at least 64 characters are permitted.
ASVS Maturity
V6.2.10
V6.2.10: Verify that a user's password stays valid until it is discovered to be compromised or the user rotates it. The application must not require periodic credential rotation.
ASVS Maturity
V6.2.11
V6.2.11: Verify that the documented list of context specific words is used to prevent easy to guess passwords being created.
ASVS Maturity
V6.2.12
V6.2.12: Verify that passwords submitted during account registration or password changes are checked against a set of breached passwords.