Passive Aggressive Passwords: the website that mocks your login

Passive Aggressive Passwords is a single-page website with one text box, and it exists to judge whatever you type into it. Enter a password and the site answers with a line of sarcasm, somewhere between a disappointed parent and a lawyer who has read too many contracts. It is a joke about a serious subject, and it is worth a look because the joke happens to teach the lesson better than most real strength meters do.

In brief

• The site lives at trypap.com and does exactly one thing: it reacts to a password with a passive aggressive comment.
• The comments escalate. Weak passwords draw open contempt, stronger ones earn grudging, backhanded praise.
• It was built by creative developer Tim Holman and designer Tobias van Schneider as a small design experiment, and it surfaced on Hacker News in 2014.
• Underneath the comedy sits a real strength estimator with a banlist of common passwords, which lands closer to modern security advice than it lets on.

What the site actually does

There is no sign-up, no account, and nothing to install. The page loads a short headline, a single input field, and a running line of commentary. As a visitor types, the commentary updates in real time, rating the password with a remark rather than a number or a colored bar. The site describes itself in its own words as a project to make the world a better place, one smile at a time, which is the sort of claim that only works when the tool is this ruthless.

The framing on the page sets the tone before anyone types. It promises to be honest about a password's strength, then qualifies that honesty as the kind you get from a lawyer or a cold hearted ex. A second line asks the visitor to imagine that their in-laws are helping choose a password, and that the comments are what the in-laws would say. That is the whole pitch. It is a strength meter with a personality disorder, and the personality is the point.

The escalating insults

The comedy comes from a scripted ladder of responses that tracks how strong the password looks. At the bottom of the ladder, the site does not hide its disgust. Short or obvious entries get lines like "Worst. Password. Ever." and "I'm not angry, just disappointed." The tone is withering and specific. One response suggests that mashing a head on the keyboard would be more secure. Another notes, flatly, "I've seen dogs with better passwords."

Push a little further and the contempt softens into something closer to coaching, still delivered sideways. A middling password earns "Close, but no cigar" or "Warmer, you're getting warmer," and the memorable "Not too shabby, for a 3 year old." The site is now rooting for the visitor, but it refuses to say so without an insult attached.

At the top of the ladder the praise arrives, grudging to the last. A genuinely strong password pulls "I knew you could get there in the end" and the deadpan "Yeah, like you're going to remember this," which is both a compliment and a warning about usability. The best entries get the classic film line "That'll do pig, that'll do." The approval never sounds sincere, which is exactly why it is funny.

The effect of this ladder is that the visitor starts optimizing for the reaction rather than the rulebook. Most strength meters reward compliance with a green bar nobody reads. This one makes a visitor want to earn the next line of begrudging respect, which turns an ignored chore into a tiny game.

The craft of the one-liners

What keeps the site rereadable is the writing. The responses are short, varied, and specific, and they avoid the lazy insult comedy of simply calling everything bad. Some land as mock concern, like "I'm not angry, just disappointed" and "I worry about you." Others reach for absurd comparison, as when the site claims to have seen dogs with better passwords or warns that toddlers eat passwords like yours for breakfast. The range is what stops the gag from wearing out after three entries.

The timing is tuned, too. Because the commentary updates as a visitor types, a single password can travel through several reactions before it is finished, so the experience feels like a running conversation rather than a verdict delivered at the end. A line such as "This password needs more emoji" arrives mid-keystroke and then gives way to something harsher or kinder as the next character lands. The feedback is continuous, which is rare, and it makes the site feel alive in a way a static rating never could.

There is restraint in the praise as well. The strong-password lines are written to withhold satisfaction: "That'll do pig, that'll do" borrows a film's affectionate condescension, and "Yeah, like you're going to remember this" undercuts the compliment with a genuine usability jab. The jokes are doing double duty, scoring the password and needling the visitor about the trade-off between strength and memorability. That is a lot of meaning to pack into a sentence fragment, and the site does it dozens of times.

Who built it

The site credits two people. Tim Holman is a creative developer with a long catalogue of playful browser experiments, catalogued at tholman.com. Tobias van Schneider is a designer and the author of a long-running design newsletter and studio, documented at vanschneider.com. The pairing shows: the writing has a developer's sense of timing, and the layout has a designer's restraint. Nothing on the page is decorated beyond what the joke needs.

The page calls the project a side project and an exploration of minimalistic design, which is an accurate description of its ambitions. It is not trying to be a product. It is trying to make a single idea land cleanly, then get out of the way. That modesty is part of why it has aged well. A heavier site built on the same gag would have felt dated years ago, but a text box and a sharp tongue do not really go out of style.

The two creators are easy to follow from the page itself, which links their accounts directly. The project reads as the kind of thing that gets made in an afternoon between larger jobs, shared for a laugh, and then quietly outlives most of the serious work around it.

How it judges a password

Behind the jokes, the site runs a real strength estimator rather than a crude length check. Its page loads a client-side complexity script together with a banlist file of common passwords, so the rating reflects two things at once: how varied and unpredictable the characters are, and whether the entry matches a well-known bad password. That is a more honest model than the old rule that a password is fine as long as it has an uppercase letter, a digit, and a symbol.

The distinction matters. A password like "Password1!" satisfies most composition rules and still fails any serious test, because it is both predictable and widely used. A long string of ordinary words, by contrast, can score very well despite breaking every composition rule a corporate form would impose. The site's sliding scale of sarcasm maps onto this reality better than a checkbox ever could, because it responds to how guessable the entry really is, not to whether it ticked some boxes.

None of this is sent anywhere. The evaluation happens in the browser, which is appropriate for a toy that invites people to type passwords they might actually use. Visitors should still treat it as a joke rather than a vault, and avoid typing a live, in-use password into any third party page on principle. The lesson survives perfectly well if the input is a password a visitor is only considering.

Why mockery is good interface design

Password strength meters have a credibility problem. Studies of real meters have found that the same password can be rated weak on one site and strong on another, because each uses its own arbitrary scoring. A meter that cannot agree with its neighbors teaches users to ignore all of them. Passive Aggressive Passwords sidesteps that trap by refusing to pretend it is precise. It offers an opinion, loudly, and an opinion is easier to argue with than a bar.

There is a real usability principle hiding here. People respond to tone, not to data. A silent green rectangle communicates approval that nobody feels, while a line of text that calls a password pathetic provokes an actual reaction. The site weaponizes embarrassment, which is one of the few forces reliably stronger than laziness. For a certain kind of visitor, being told a toddler could do better is more motivating than any security policy.

The design also respects attention. It asks for one input and returns one sentence. There are no modal dialogs, no progress rings, and no checklist of requirements that turns red one item at a time. By compressing the entire interaction into a single line of feedback, it makes the feedback impossible to ignore, which is the one job a strength meter has and the one job most of them quietly fail.

How it lines up with modern guidance

The joke turns out to agree with the experts. The United States National Institute of Standards and Technology rewrote its digital identity guidance to favor length over forced complexity, to drop mandatory periodic password changes, and to screen new passwords against lists of commonly used and compromised values. That guidance lives in NIST Special Publication 800-63B, and it reads like a rebuke of the uppercase-digit-symbol era.

Passive Aggressive Passwords, built years before that advice became mainstream, already behaves this way. It carries a banlist, so it sneers at common passwords regardless of how they are decorated. It rewards unpredictability rather than the presence of a particular symbol. A visitor who chases its grudging approval ends up doing roughly what NIST would recommend, without reading a single page of a standards document. The site is accidental compliance training with a bad attitude.

It is not a replacement for a password manager, and it would never claim to be. The responsible modern answer is to let software generate long random strings and remember them, so that no human ever needs to invent a password worth mocking. But as a way to feel the difference between a guessable password and a strong one, in the time it takes to type, the site does more teaching than most security awareness slides.

How to actually climb the ladder

For anyone who wants to earn the site's reluctant respect, the path is the same one security researchers now recommend. Length beats punctuation tricks. A string of four or five unrelated words is both easier for a person to remember and harder for a machine to guess than a short password dressed up with a capital letter and an exclamation mark. The toy rewards that unpredictability directly, because its underlying estimator cares about how much a password varies, not about which specific symbols appear.

Substitutions that feel clever rarely are. Replacing an o with a zero or an a with an at sign does almost nothing against modern guessing tools, which know every common substitution by heart. The site's banlist reflects this by refusing to be impressed by decorated versions of popular passwords. A visitor chasing a better line of commentary learns quickly that adding length and genuine randomness moves the needle, while cosmetic tweaks earn more contempt.

The deeper lesson is that no human should be inventing most of their passwords at all. A password manager generates long random strings and remembers them, which removes the memorability trade-off the site keeps joking about. The toy is best understood as a demonstration of what strength feels like, not as a tool for choosing a password to keep. Once the difference is obvious, the sensible move is to hand the job to software and never face the in-law commentary again.

Where it sits among single-purpose sites

Passive Aggressive Passwords belongs to a small genre of websites that take one mundane interaction and give it a voice. These sites survive because they are complete. There is nothing to learn, nothing to configure, and no reason to return except the pleasure of the thing itself. The format rewards a sharp idea executed without padding, which is precisely what a one-field insult machine is.

Readers who enjoy a site built around a single deadpan interaction will find kindred spirits across the wider web of tiny, purposeful pages. The same instinct that animates a password machine with a sarcastic streak powers places like The Bureau of Tiny Approvals, where the bureaucratic tone is the entire experience. Both understand that a strong voice can carry a website that does almost nothing, as long as it does that nothing with conviction.

The practical takeaway is small and genuine. Visit trypap.com, type a few candidate passwords, and watch the commentary climb from contempt toward reluctant respect. It costs nothing, teaches something real about what makes a password weak, and leaves a smile on the way out, which is more than most security tools manage.

FAQ

Does Passive Aggressive Passwords store what I type?

The strength rating is computed in the browser using a client-side script, so the evaluation itself does not require sending the password to a server. Even so, visitors should treat the page as a toy and avoid typing a password they currently use anywhere important, which is good practice on any third party site.

Who made it?

It was built by creative developer Tim Holman and designer Tobias van Schneider as a small design experiment. Their work is at tholman.com and vanschneider.com, and the project was shared on Hacker News in 2014.

Is it an accurate way to measure password strength?

It uses a real complexity estimator and a banlist of common passwords, so its relative judgments are reasonable and it penalizes predictable entries. It is a teaching toy, not a security product, and the reliable approach is still a password manager that generates and stores long random strings.

Why does the praise sound like an insult?

That is the entire concept. The site rates passwords on a sliding scale of sarcasm, so even a strong password earns backhanded approval rather than genuine warmth. The tone is designed to provoke a reaction, since embarrassment motivates people to improve a password more reliably than a silent green bar.