diff --git a/tests/test_passwords.py b/tests/test_passwords.py
new file mode 100644
index 0000000..ab16371
--- /dev/null
+++ b/tests/test_passwords.py
@@ -0,0 +1,35 @@
+import pytest
+
+from app.core.passwords import (
+    WeakPasswordError,
+    hash_password,
+    validate_policy,
+    verify_password,
+)
+
+STRONG_PASSWORD = "Kz8#Fj2!Lm9@Qw4$xR"
+
+
+# слабый пароль должен отклоняться
+def test_short_password_rejected():
+    with pytest.raises(WeakPasswordError):
+        validate_policy("short")
+
+
+# слабый пароль должен отклоняться
+@pytest.mark.parametrize("weak", ["password", "12345678", "aaaaaaaaaaaa"])
+def test_known_weak_passwords_rejected(weak):
+    with pytest.raises(WeakPasswordError):
+        validate_policy(weak)
+
+
+# корректный – приниматься
+def test_strong_password_accepted():
+    validate_policy(STRONG_PASSWORD)
+
+
+# хэш должен успешно проверяться
+def test_hash_roundtrip():
+    hashed = hash_password(STRONG_PASSWORD)
+    assert verify_password(STRONG_PASSWORD, hashed) is True
+    assert verify_password("definitely-wrong", hashed) is False