Check new passwords against a password policy — interview question

A college portal checks new passwords at sign-up. For each username password pair, check these rules in this order:

LENGTH: at least 12 characters.
UPPER: at least one uppercase letter A–Z.
LOWER: at least one lowercase letter a–z.
DIGIT: at least one digit 0–9.
SYMBOL: at least one character that is not a letter or digit.
USERNAME: must not contain the username, ignoring case.

Print OK if every rule passes. Otherwise print WEAK followed by the names of the failed rules, in the order above.

Constraints

1 ≤ n ≤ 1000
1 ≤ password length ≤ 64; usernames are lowercase letters.

Input and output

Input: First line: n. Then n lines `username password`. Neither contains spaces.
Output: n lines: `OK` or `WEAK RULE1 RULE2 ...`.

Examples

Input 1

3
riya Riya2026!
kabir Sunflower#Field42
dev hello

Output

WEAK LENGTH USERNAME
OK
WEAK LENGTH UPPER DIGIT SYMBOL

Line 1 is too short and contains the username "riya" (in a different case). Line 2 passes every rule. "hello" fails four rules.

Input 2

1
sana correcthorsebatterystaple

Output

WEAK UPPER DIGIT SYMBOL

Long, but no uppercase letter, digit or symbol.

Show hints

any(c.isupper() for c in pw) style checks, one per rule, keep the code readable.
Lower-case both strings before the username check.

Show the explanation

Python

def check(user, pw):
    failed = []
    if len(pw) < 12: failed.append("LENGTH")
    if not any("A" <= c <= "Z" for c in pw): failed.append("UPPER")
    if not any("a" <= c <= "z" for c in pw): failed.append("LOWER")
    if not any("0" <= c <= "9" for c in pw): failed.append("DIGIT")
    if all(c.isascii() and c.isalnum() for c in pw): failed.append("SYMBOL")
    if user.lower() in pw.lower(): failed.append("USERNAME")
    return "OK" if not failed else "WEAK " + " ".join(failed)

Report every failed rule at once, so the user can fix them all in one go. That is good usability as well as good security.

What a security interviewer will ask next

Length matters most. Current NIST guidance (SP 800-63B) emphasises a minimum length (and allowing long passphrases), checking new passwords against lists of known-breached and common passwords, and not forcing arbitrary composition rules or regular expiry. Composition rules like the ones above are still common in practice, but they push users towards predictable patterns such as Password@123. Mention both.
Never store the password. Hash it with a slow, salted password-hashing function (Argon2id, scrypt or bcrypt), and compare hashes in constant time.
Check on the server. Client-side checks only improve the user experience, because a request can bypass the browser.
Rate-limit login attempts and offer multi-factor authentication. These stop far more account takeovers than complexity rules do.
Do not log or echo passwords, even rejected ones. This exercise prints only the rule names for that reason.

Original UniCircle question. Last reviewed 22 Oct 2026.