Why Complex Password Rules Make Passwords Weaker
Many sites still demand a capital letter, a number and a symbol. Research and standards bodies show that this encourages weak, predictable passwords.
How people respond
- Capitalise the first letter.
- Add a number at the end.
- Replace letters with look-alike symbols.
- Change one digit at each forced update.
What modern guidance says
Standards bodies recommend allowing long passwords, checking against known breached lists and avoiding mandatory periodic changes without a reason.
What you should do
Ignore the rules as a goal and focus on length and uniqueness. Let a manager generate random passwords and use passphrases where you must type one.
Key takeaway: Length, uniqueness and breach checks matter far more than symbols and forced changes.
