Password rules at sign-up: the friction that protects nobody

You try to create an account. The password you chose is rejected: it needs a capital letter. You add one. Rejected again: it needs a symbol. You add an exclamation mark at the end. Accepted. You have just created a password that is longer than before, follows every rule and is about as predictable as a password can be.

A password rule that people can only satisfy with Password1! has protected nobody. This piece looks at why so many sign-up forms still impose such rules, what security guidance now recommends instead, and how our own form measures up.

The composition rules

Composition rules require a mix of character types: upper and lower case, digits, symbols. The idea is to make passwords harder to guess by increasing the number of possibilities.

In practice, people respond predictably. The capital goes at the start, the number and the symbol go at the end, and the result is a familiar word with decorations. Attackers know these patterns and try them first.

Forced changes

Another common rule forces a new password every few months. The intention is to limit the damage of a stolen password. The result is often a sequence: Summer2025!, Autumn2025!, Winter2025!. Each new password is easy to guess from the last.

What guidance now favors

Security guidance has shifted over the past decade. Influential public guidelines, such as those published by the United States standards agency, now generally recommend:

• length over complexity, with a reasonable minimum and a generous maximum;
• checking new passwords against lists of known compromised passwords;
• no arbitrary composition rules;
• no forced periodic changes, unless there is evidence of compromise;
• allowing paste, so password managers work;
• limiting repeated guessing at the server.

The emphasis moved from making people's passwords complicated to making attacks harder.

Password managers change the picture

A password manager generates long, random passwords and fills them in. For people who use one, composition rules are irrelevant: the generated password satisfies anything. Forms that block pasting or impose odd maximum lengths get in the way of the people doing the most to protect themselves.

A second step matters more

The biggest improvement to account security is not a stricter password rule; it is a second sign-in step. With an authenticator app, a stolen or guessed password alone is not enough. That is why we made two-step sign-in mandatory for every account, as we explained in our case file about two people and one shared login, where a password alone opened everything.

Breached-password checks

Checking a new password against lists of passwords exposed in earlier breaches is one of the most effective rules available. It rejects exactly the passwords attackers try first, without forcing patterns on anyone. Some services do this without sending your password anywhere, by sending only a fragment of a hash to a lookup service.

Our own rule, honestly

Our sign-up asks for at least ten characters. On the live site, the password must also include upper- and lower-case letters and numbers, and it is checked against public lists of breached passwords, sending only a short fragment of a hash. A strength meter shows how the password is doing as you type.

By the guidance above, our composition requirement is the weakest part of that rule: it nudges people toward the very patterns described here. We keep it for now alongside the length and breach checks, and we would rather say so than pretend the rule is perfect. The mandatory authenticator step does most of the protecting either way.

What sign-up forms should do

A fair sign-up form:

1. sets a sensible minimum length and allows long passwords;
2. shows the rules before you type, not after you fail;
3. checks against known breached passwords;
4. allows paste and password managers;
5. offers or requires a second sign-in step;
6. never emails your password back to you.

Why bad rules persist

Old rules persist because they look rigorous, because audits and checklists still sometimes ask for them, and because changing them requires someone to argue that a rule that feels stricter is actually weaker. Every one of those reasons is about appearances. Phone numbers as a security fallback have a similar history, as we described in why every app wants your phone number.

Security questions are passwords too

Many sign-up forms add security questions: your mother's maiden name, the street you grew up on, your first pet. The answers are often easy to find on social media or in public records, which makes them a weak back door into an account protected by a strong password.

If a service insists on security questions, treat the answers as extra passwords: give answers that are not true and store them in your password manager. A security question that a stranger could research is not security; it is a second, weaker password with a friendlier label.

When a site sends your password back

If a service ever emails you your actual password, after sign-up or in a "forgot password" flow, it is storing that password in a form it can read. That means anyone who breaks into its systems may be able to read it too. A well-built service can only reset a password, never reveal it. If you receive one, change that password, and change it anywhere else you used it.

Showing the password

A small feature makes long passwords easier to type correctly: a button that shows the password as you enter it. Masking every character made sense on shared office terminals; on a personal phone, it mostly causes typing errors and drives people toward short passwords they can type blind. A show button, off by default, lets people choose.

Questions people ask

What makes a good password?

Length and unpredictability. A long passphrase or a random password from a manager is better than a short complex one.

Should I change my passwords regularly?

Change a password when there is a reason, such as a breach or a suspicion of misuse. Use a different password for every site.

Is two-step sign-in worth the extra seconds?

Yes. It stops most account takeovers that start with a stolen password. Our help center explains how to set it up and store recovery codes.