Making strong secrets · 4 min read
Password rules that backfire
Many familiar password rules make passwords more predictable or push people toward unsafe habits. NIST SP 800-63B-4 now forbids several of them outright.
Password rules are written to make guessing harder. Several of the most common ones do the opposite, or move the risk somewhere else. NIST’s SP 800-63B-4 (2025) addresses most of them directly, and its Appendix A explains why: requirements beyond the essentials “significantly increase user frustration,” and “users often work around these restrictions counterproductively.”
Here are the rules that tend to backfire, what NIST says about each, and where the cost can be counted.
1. “Must contain an uppercase letter, a digit and a symbol”
What NIST says: “Verifiers and CSPs SHALL NOT impose other composition rules (e.g., requiring mixtures of different character types) for passwords.”
Why it backfires: People meet the rule in predictable ways: a capital at the start, a digit and a symbol at the end. NIST’s own example is “password” becoming “Password1” and then “Password1!”. Attackers try those transformations early. See length beats complexity.
Worked example: what the rule does to a random password
Even for a computer-generated password, the rule slightly reduces the number of possibilities, because it throws out strings that happen to miss a class. Take 8 random characters from the 94 printable ASCII characters (26 lowercase, 26 uppercase, 10 digits, 32 symbols):
- Without the rule: 94^8 = 6,095,689,385,410,816 strings, 52.44 bits.
- With “at least one of each class,” counted exactly by inclusion-exclusion: 2,807,657,387,458,560 strings, 51.32 bits.
Only about 46% of random 8-character strings satisfy the rule, so it costs a random password about 1.12 bits. That is small, and a good generator can account for it exactly. The real damage is to human-chosen passwords, where the rule pushes everyone toward the same few shapes.
2. A short maximum length
What NIST says: Verifiers “SHOULD permit a maximum password length of at least 64 characters.” Appendix A adds that “there is no reason to prohibit the use of lengthy passwords (or passphrases),” since the stored hash is the same size whatever the password’s length.
Why it backfires: A cap rules out passphrases. A six-word passphrase from the EFF list averages about 47 characters with spaces; a 16- or 20-character cap forces people back to short, decorated words.
3. Silently cutting the password short
What NIST says: Verifiers “SHALL verify the entire submitted password (e.g., not truncate it).”
Why it backfires: If a system quietly keeps only the first 8 characters, a 20-character random password (131.09 bits from the 94-character set) is checked as an 8-character one: 52.44 bits. The user believes they have the first and gets the second. See password length limits.
4. Rejecting spaces and “special” characters
What NIST says: Verifiers “SHOULD accept all printing ASCII [RFC20] characters and the space character in passwords,” and should accept Unicode. Appendix A notes that bans on certain characters are sometimes meant to block injection attacks, but “an unhashed password would not be sent intact to a database, so such precautions are unnecessary.”
Why it backfires: It blocks passphrases with spaces and breaks generated passwords that use the full character set.
5. Blocking paste and password managers
What NIST says: “Verifiers SHALL allow the use of password managers and autofill functionality. Verifiers SHOULD permit claimants to use the ‘paste’ function when entering a password…”
Why it backfires: If pasting is blocked, a long random password from a manager has to be retyped by hand, which pushes people toward short, memorable ones. NIST notes that password managers “have been shown to increase the likelihood that subscribers will choose stronger passwords.”
6. Forced changes every N days
What NIST says: “Verifiers and CSPs SHALL NOT require subscribers to change passwords periodically. However, verifiers SHALL force a change if there is evidence that the authenticator has been compromised.”
Why it backfires: Scheduled changes encourage small, predictable edits to the old password, such as incrementing a number. Changing passwords regularly works through the numbers.
7. Password hints
What NIST says: Verifiers “SHALL NOT permit the subscriber to store a hint (e.g., a reminder of how the password was created) that is accessible to an unauthenticated claimant.”
Why it backfires: A hint visible before login is visible to the attacker too. A hint like “my dog’s name plus the year” turns a search over all passwords into a search over a short list of names and years.
8. Security questions
What NIST says: Verifiers “SHALL NOT prompt subscribers to use knowledge-based authentication (KBA) (e.g., ‘What was the name of your first pet?’) or security questions when choosing passwords.”
Why it backfires: Answers to such questions are often findable or guessable and are rarely random. A strong password with a weak security question behind it is only as strong as the question. See security questions.
Rules that do help
NIST doesn’t drop requirements; it replaces them with ones that work better:
| Requirement in SP 800-63B-4 | What it does |
|---|---|
| Minimum 15 characters for a password used on its own (8 if part of multi-factor) | Makes short passwords impossible and nudges toward phrases |
| Check new passwords against a blocklist of “commonly used, expected, or compromised” values | Stops the passwords attackers try first |
| Tell the user why a password was rejected and offer guidance | Discourages “trivial modifications of listed weak passwords” |
| Rate-limit failed attempts, “no more than 100” consecutive failures | Makes online guessing slow |
| Store passwords salted and hashed with an expensive function | Slows offline guessing after a breach |
Appendix A’s summary: “Other mitigations (e.g., blocklists, secure hashed storage, machine-generated random passwords, rate limiting) are more effective at preventing modern brute-force attacks.”
Note: Many sites still enforce older rules. When one demands a digit and a symbol, a generated password can meet the rule with only the small cost shown above. The strength checker shows how predictable a typed password’s shape is, line by line.
Sources
General explanation, not advice for a particular situation. Updated 2026-10-31.